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HEARING ON PROMOTING THE ADOPTION 
AND USE OF HEALTH INFORMATION 
TECHNOLOGY 


THURSDAY, JULY 24, 2008 

U.S. House of Representatives, 

Committee on Ways and Means, 

Subcommittee on Health, 

Washington, DC. 

The Subcommittee met, pursuant to notice, at 10:05 a.m. in room 
1100, Longworth House Office Building, Hon. Fortney Pete Stark 
(Chairman of the Subcommittee) presiding. 

[The advisory announcing the hearing follows:] 
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ADVISORY 

FROM THE COMMITTEE ON WAYS AND MEANS 


SUBCOMMITTEE ON HEALTH 


FOR IMMEDIATE RELEASE CONTACT: (202) 225-3943 

July 17, 2008 

HL-28 

Hearing on Promoting the Adoption and Use of 
Health Information Technology 

House Ways and Means Health Subcommittee Chairman Pete Stark (D-CA) an- 
nounced today that the Subcommittee on Health will hold a hearing on promoting 
health information technology. The hearing will take place at 10:00 a.m. on 
Thursday, July 24, 2008, in the main committee hearing room, 1100 Long- 
worth House Office Building. 

In view of the limited time available to hear witnesses, oral testimony at this 
hearing will be from invited witnesses only. However, any individual or organization 
not scheduled for an oral appearance may submit a written statement for consider- 
ation by the Committee and for inclusion in the printed record of the hearing. 

BACKGROUND : 

Adoption and use of comprehensive, fully interoperable health information tech- 
nology (IT) can be a critical tool in efforts to improve clinical outcomes and reduce 
costs in the health care system. The Congressional Budget Office said in a recent 
report, “Health information technology has the potential to significantly increase the 
efficiency of the health care sector. ... It could also improve the quality of health 
care and, ultimately, the outcomes of that care for patients.” 1 In purely financial 
terms, the RAND Corporation estimates that widespread adoption of health IT has 
the potential to reduce system-wide health care spending by up to $80 billion annu- 
ally. 2 At the same time, health IT could improve clinical outcomes by preventing 
medical errors, improving the practice of evidenced-based medicine, reducing dis- 
parities in the delivery of care, eliminating redundant tests and procedures, and 
generating data for health care research. 

But these potential benefits come with a cost. Studies indicate that the total in- 
vestment needed to achieve a nation-wide health IT network could be more than 
$100 billion. 3 

Though the United States has consistently been a leader in the field of informa- 
tion technology, this country lags 5 to 15 years behind countries like Australia, Can- 
ada, Germany, Norway and Great Britain in terms of the dissemination and use of 
interoperable health IT systems. 4 The time has come for the American health care 
system to get serious about fully utilizing this important tool. 

Key issues to be discussed include: (1) the potential costs and benefits associated 
with the adoption of health IT, (2) options to ensure adoption through effective in- 
centives, (3) ensuring that incentives are tied to systems that are fully interoperable 
and have necessary clinical capabilities, and 4) protecting patient privacy and the 
security of health information. 


1 http://www.cbo.gov/ftpdocs/91xx/doc9168/05-20-HealthIT.pdf. 

2 http://www.rand.org/pubs/monographs/2005/RAND MG410.pdf. 

3 Kaushal and others “The Costs of a National Health Information Network” Annals of Inter- 
nal Medicine 2005. Walker and others “The Value of Health Care Information Exchange” Health 
Affairs 2005. 

4 Anderson, Frogner, Johns and Reinhardt, “Health Care Spending and Use of Information 
Technology in OECD Countries” Health Affairs 2006. 
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In announcing the hearing Chairman Stark said, “In many ways America has 
the most advanced health care system in the world. But the way medical 
records are stored and transferred in this country is right out of the 19th 
Century. If we create a system where an emergency doctor in St. Louis has 
instant access to the medical records of a patient who lives in Oakland, we 
will dramatically improve the quality of care while simultaneously reduc- 
ing costs. It’s a win-win situation. But the lack of progress to date shows 
the need for strong federal leadership and real investment in order to real- 
ize those benefits.” 

FOCUS OF THE HEARING : 

The hearing will focus on options to encourage the adoption and use of a secure, 
clinically comprehensive, and fully interoperable health information technology sys- 
tem. 

DETAILS FOR SUBMISSION OF WRITTEN COMMENTS : 

Please Note: Any person(s) and/or organization(s) wishing to submit for the hear- 
ing record must follow the appropriate link on the hearing page of the Committee 
website and complete the informational forms. From the Committee homepage, 
http : / / waysandmeans.house.gov, select “110th Congress” from the menu entitled, 
“Committee Hearings” (http: // waysandtneans.house.gov I Hearings.asp?congress=18). 
Select the hearing for which you would like to submit, and click on the link entitled, 
“Click here to provide a submission for the record.” Follow the online instructions, 
completing all informational forms and clicking “submit”. Attach your submission as 
a Word or WordPerfect document, in compliance with the formatting requirements 
listed below, by close of business Thursday, August 7, 2008. Finally, please note 
that due to the change in House mail policy, the U.S. Capitol Police will refuse 
sealed-package deliveries to all House Office Buildings. For questions, or if you en- 
counter technical problems, please call (202) 225-1721. 

FORMATTING REQUIREMENTS: 


The Committee relies on electronic submissions for printing the official hearing record. As al- 
ways, submissions will be included in the record according to the discretion of the Committee. 
The Committee will not alter the content of your submission, but we reserve the right to format 
it according to our guidelines. Any submission provided to the Committee by a witness, any sup- 
plementary materials submitted for the printed record, and any written comments in response 
to a request for written comments must conform to the guidelines listed below. Any submission 
or supplementary item not in compliance with these guidelines will not be printed, but will be 
maintained in the Committee files for review and use by the Committee. 

1. All submissions and supplementary materials must be provided in Word or WordPerfect 
format and MUST NOT exceed a total of 10 pages, including attachments. Witnesses and sub- 
mitters are advised that the Committee relies on electronic submissions for printing the official 
hearing record. 

2. Copies of whole documents submitted as exhibit material will not be accepted for printing. 
Instead, exhibit material should be referenced and quoted or paraphrased. All exhibit material 
not meeting these specifications will be maintained in the Committee files for review and use 
by the Committee. 

3. All submissions must include a list of all clients, persons, and/or organizations on whose 
behalf the witness appears. A supplemental sheet must accompany each submission listing the 
name, company, address, telephone and fax numbers of each witness. 


Note: All Committee advisories and news releases are available on the World 
Wide Web at http://waysandmeans.house.gov. 

The Committee seeks to make its facilities accessible to persons with disabilities. 
If you are in need of special accommodations, please call 202-225-1721 or 202-226- 
3411 TTD/TTY in advance of the event (four business days notice is requested). 
Questions with regard to special accommodation needs in general (including avail- 
ability of Committee materials in alternative formats) may be directed to the Com- 
mittee as noted above. 
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Chairman STARK. If our guests could find a seat, then we will begin the hearing 
today to discuss the importance of electronic medical records, and the need to pro- 
mote their adoption and use by the medical community. 

There is little doubt that the U.S. health care system is among the most advanced 
in the world, in terms of diagnosing and treating disease. But when it comes to med- 
ical records, we are stuck in the 19th century. This IT shortfall hampers our ability 
to provide the best care when people are ill. 

In my former life, as near as I can remember, when I was banker I helped to cre- 
ate the way financial information was stored and electronically transmitted for cred- 
it cards in this country. You can go to virtually any ATM in the country and in- 
stantly withdraw money or, as I do, get notice that I am overdrawn, and I can de- 
posit money in a different bank, or see certain account information. This technology 
now allows me to receive and pay bills online. We still can’t do the same with our 
medical records. 

I am not in the habit of using props, but one of the members of our staff gave 
me a copy of 2 years — this is a young man behind me — 2 years of his medical 
records. This is it. It’s over 500 pages, weighs 5 pounds, and it cost more than $6 
to ship it. Getting these records required our staff person to make several phone 
calls to his doctor, pay a medical records company $127 to copy and print it. Yet, 
this is the only way he could get his records from one physician to another, and 
because they’re not stored electronically. 

As I say, that is — it’s just a useful illustration of some of the problems that our 
medical providers face in trying to do that. I would hate to look and go back start- 
ing, I guess, in the Air Force, when I started getting medical records. I will bet mine 
are a couple of feet high. 

The widespread use of electronic medical records holds promise for increasing the 
quality of health care and bringing down costs. EMR’s, electronic medical records, 
by themselves may have little impact on the cost. But they would allow us to pro- 
ceed with comparative effectiveness research, put emphasis on disease management 
through primary care, and it has the potential to save our Nation’s health care sys- 
tem billions — perhaps hundreds of billions — of dollars. 

Despite its promise, we are years behind other countries in terms of getting doc- 
tors, hospitals, other providers to use modern technology. In Germany, they began 
an effort back in 1993. Canada started in 1997. Britain began its work in 2002. 
These countries have also invested billions of dollars in government funds toward 
developing their systems. By contrast, we are stuck in a rut. 

We guess that perhaps 10 to 20 percent of the physicians in this country have 
a meaningful electronic medical records system, and the adoption rates of hospitals 
is probably not much better than 20 or 30 percent. 

It wasn’t until 2004 that the Federal Government realized the need for leadership 
on this issue, when President Bush said that every American should have an elec- 
tronic medical record by 2014. By executive order, he established an office within 
Health and Human Services to lead this effort. 

While the President and I happen to agree on this important issue — and we don’t 
agree on much — I would point out that Health and Human Services has moved rath- 
er slowly since the President’s request. The Agency seems more concerned with the 
vendors and other entrenched interests than in getting the job done. The lack of 
progress to date is why we have called this hearing, and it is why we will introduce 
legislation designed to promote — and I want to underline promote — the adoption 
and use of electronic medical records while protecting patient privacy. I would just 
like to emphasize that. 

This should not be seen as an effort to slow down other commendable legislative 
efforts in this area. The opposite is true. Our bill would be designed to speed up 
the development of electronic medical record technology, covering three major 
points: to ensure that the Federal Government continues to promote development 
of a comprehensive, fully interoperable electronic medical records system; provide 
meaningful financial incentives through the Medicare Program that will, hopefully, 
overcome barriers to adoption; and take the necessary steps to protect the security 
and privacy of patient records, by giving individuals the right and ability to sue for 
damages when their records are breached. 

We can continue this discussion after we have heard the testimony. I would like 
to recognize Mr. Camp for comments that he would like to make. 

Mr. CAMP. Well, thank you very much, Mr. Chairman. I want to thank all the 
witnesses for being here. 

Paper-based records are an expensive, antiquated relic from the last century. 
Paper records harm patients, increase costs, and lead to lower quality care. For the 
21st century, we need electronic health records. 
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The question that needs to be answered is not whether we need to have better 
health information technology. We all know the answer to that is a resounding yes. 
The real and more difficult question is, how can we achieve that goal, and what role 
the Federal Government should play in getting physicians and hospitals to adopt 
health IT. 

Should Congress provide physicians and hospitals with Federal subsidies to speed 
adoption, or are there smarter approaches that we can pursue? Should the Federal 
Government pick which information system wins the standard sweepstakes, or 
should a public-private partnership establish an interoperability framework that 
vendors would have to meet? 

How can we ensure that patients’ privacy is protected, while making sure that 
physicians have access to the medical data they need to make an informed decision? 

I have introduced a bill that attempts to strike a balance between these competing 
schools of thought. The Promoting Health Information Technology Act would estab- 
lish a public-private entity to develop and recommend interoperability standards, 
would increase the business depreciation expense to facilitate adoption, and allow 
hospitals and group practices to provide needed software to physicians, and protect 
the HIPAA privacy standard, and commissions a study to determine whether extra 
protections might be needed. 

This approach will speed the adoption of workable electronic health records that 
will enable physicians and hospitals to provide better value to their patients. In ad- 
dition, it will assist health care providers in avoiding unnecessary procedures, en- 
couraging the timely utilization of preventative care, and empowering patients to 
take a more active role in their own health care. 

I think it is very important to hear what is happening in the private sector. Due 
to the weather last night, Douglas Reding, a physician from the Marshfield Clinic 
in Marshfield, Wisconsin, was unable to be here. He was going to be a part of the 
panel, and was going to testify on that important aspect. We have agreed that this 
testimony will become part of the record. 

Chairman STARK. Without objection. 

[The prepared statement of Mr. Reding follows:] 

Prepared Statement of Douglas J. Reding, MD, MPH, FACP, 

Vice President, Marshfield Clinic, Marshfield, Wisconsin 

This testimony is presented on behalf of the physicians and staff of Marshfield 
Clinic, who thank you for conducting this hearing on promoting the adoption and 
use of health information technology. We appreciate the opportunity to share our 
views regarding the potential for HIT to revolutionize health care and provide the 
necessary decision support to incorporate evidence based decision making into clin- 
ical care processes. We recognize that there is a large public and clinical education 
gap that must be bridged for Congress to begin to address the quality and financial 
challenges facing health care delivery. We appreciate the difficulty of the represen- 
tational issues you must address. 

This document will summarize the following: (1) After nearly 40 years of IT devel- 
opment work and expenses approximating three to four percent of its annual budget 
(currently at $950 million/year) Marshfield Clinic has completely converted to an 
electronic record format and is paperless in all of its 43 facilities. (2) Marshfield 
Clinic invested in the technology out of a conviction that the pace of scientific dis- 
covery, the pressure for increased productivity, and the intellectual demands of the 
practice of medicine vastly exceed any individual’s capacity for the timely processing 
of all the pertinent clinical information about a patient, and the provision of state 
of the art care. To provide anything less would compromise patient safety and care. 
(3) While we see the expenses associated with the implementation of HIT as a nec- 
essary part of the cost of doing business, the federal Medicare practice expense for- 
mulas for reimbursing physicians for the cost of patient care have never adequately 
covered the cost of providing services to Medicare patients, especially those costs as- 
sociated with HIT, and this has had a limiting impact on the proliferation of HIT 
throughout the medical community. (4) We have shown through participation in the 
CMS Physician Group Practice Demonstration that our electronic medical record 
and the associated databases empower our physicians and their staff to improve pa- 
tient care outcomes and reduce costs to the Medicare program. (5) We recommend 
that Congress provide incentives for the utilization of HIT and care management 
systems that add value to patient care. At a minimum HIT must facilitate meeting 
the Institute of Medicine’s aims for health care delivery assuring that care is safe, 
timely, efficient, effective, patient centric and equitable. 

Marshfield Clinic (the “Clinic”) is the largest private group medical practice in 
Wisconsin and one of the largest in the United States. It is one of only a few large 
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independent not-for-profit, tax-exempt medical clinics in the United States. The 
Clinic is engaged in providing quality health care, health care education, and med- 
ical research. The Clinic owns and operates outpatient clinical, educational, and re- 
search facilities with its main clinical facilities and administrative offices located in 
Marshfield, Wisconsin. The Clinic currently employs more than 780 physicians and 
6500 additional staff. The Clinic has 42 regional centers in addition to the 
Marshfield location and operates in 35 Wisconsin communities throughout Central, 
Western, and Northern Wisconsin, which is a predominantly rural area. Marshfield 
Clinic has developed and acquired sophisticated tools, technology, and other re- 
sources that complement and support the population health management mission 
and strategy of the Clinic. These include an electronic medical record, a data ware- 
house, an immunization registry, and an epidemiological database that enable en- 
hanced definitions of disease states, diagnoses or conditions, and cost analysis of 
CPT level interventions. Marshfield Clinic’s 43 regional centers are linked by com- 
mon information systems. With this infrastructure, the Clinic is presently publicly 
reporting clinical outcomes, and providing physicians and staff quality improvement 
tools to analyze their clinical and business processes, eliminate waste and unneces- 
sary redundancies, and improve consistency while simultaneously reducing unneces- 
sary costs. The Clinic’s largest facilities are adjacent to St. Joseph’s Hospital of 
Marshfield, Inc., a 524 approved-bed acute care and teaching hospital, which is 
owned and operated by Ministry Health Care, Inc., a tax-exempt organization, 
headquartered in Milwaukee, Wisconsin. 

We believe that health information technology has the potential to significantly 
increase clinical care efficiency by reducing costs and increasing value (defined as 
quality/cost) by enabling providers to manage information. To the extent that a pro- 
vider can manage what he/she can measure, HIT enables performance measurement 
and the improvement of patient care outcomes. In many, but not all avenues, im- 
provement in patient care also leads to efficiencies and savings, primarily through 
reductions in hospitalizations, readmissions, and the utilization of intensive serv- 
ices. 

For this reason we believe that the Federal Government should stimulate the 
adoption, and utilization of HIT. As the Congressional Budget Office has recently 
shown, 85 percent of Medicare expenditures are concentrated among 25 percent of 
beneficiaries, and CMS has shown us that this population is predominantly individ- 
uals who have four or more chronic conditions. We recommend that Congress should 
initially subsidize the use of HIT through the Medicare program to promote rapid 
assimilation of the skill sets that are associated with the management of chronic 
disease. While the time factor associated with this cultural change in the practice 
of medicine may be protracted, ultimately it may be appropriate for the Federal 
Government to phase out the subsidies and impose penalties on providers who fail 
to achieve defined standards of professionalism in their utilization of health 
informatics resources. 

Marshfield Clinic has long used information systems to facilitate care process re- 
design for patients with chronic illnesses, and the organization expanded its efforts 
after becoming a participant in the Center for Medicare and Medicaid Services 
(CMS) Physician Group Practice (PGP) Demonstration project. As a result of these 
expanded efforts, Marshfield Clinic enhanced access to care, reduced hospitaliza- 
tions and costs, and became one of two PGP sites (out of 10 total) to earn a perform- 
ance bonus from CMS in FY 2007. Results of the second year of the demonstration 
are forthcoming in the next few weeks, but we are embargoed under CMS’ terms 
and conditions of the demonstration from discussing the results. Leave it to say that 
we are confident that care management works, and may be enhanced through HIT 
applications. 

Description of the Marshfield Clinic electronic medical record 

Marshfield Clinic is unique in that is has developed its own electronic health 
records and ancillary reporting systems over the last thirty years. The system, 
called Cattails MD, was the first internally-developed system to gain CCHIT certifi- 
cation last year, and has recently been made available for resale in the EHR mar- 
ketplace. 

The clinic first implemented an EMR in 1985, and over time the practice has pro- 
moted adoption of the full functionality of the system. Since 2003, Marshfield Clinic 
has been deploying portable wireless tablet computers that led to a chartless med- 
ical environment by the end of 2007. All physicians and their support staff now use 
the tablet computers, which are linked to the Clinic’s sophisticated electronic med- 
ical record. With wireless computers, providers can instantly access confidential 
medical history, radiology reports and images, test results and expert opinions. They 
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can take notes, enter orders and write prescriptions electronically. Our physicians 
say that their practice is much more organized and efficient with the use of the tab- 
let. It brings what previously was only available at our desktop into the exam room. 

Our physicians can track blood pressure readings and lab results on tablet com- 
puters and check which preventive screenings, such as mammography or 
colonoscopy, are due. They can show their patients diagrams or streaming video of 
procedures they may undergo. 

Storing, retrieving and updating paper charts is time-consuming and costly. Exam 
room access to electronic records enhances patient security, reduces errors and 
eliminates duplicate tests, all of which allows us to provide better care. We estimate 
that the elimination of pulling paper charts alone has resulted in a $7 million sav- 
ings annually. Patient medical records are accessible to those who need to know 
throughout the Marshfield Clinic system, and will be available at the Clinic’s affili- 
ated hospitals. 

Providers can instantly print out patient educational materials rather than leav- 
ing the exam room to search for information. When a provider can take the time 
to educate patients about diseases, risk factors and recommendations to improve 
their health, patients are more likely to comply. The ability to quickly get informa- 
tion clearly improves the quality of the patient visit. 

Imagine your elderly mother has chest pain in the middle of the night. You bring 
her to the emergency department of your hospital. She can’t remember the medica- 
tions she takes. If she is a Marshfield Clinic patient her medical record is instantly 
available to the emergency room physician caring for her. Her medications, aller- 
gies, X-rays, electrocardiogram and notes from past medical exams are available 
electronically. The physician has instant access through a wireless computer tablet 
linked to Marshfield Clinic’s sophisticated, integrated electronic medical record. 

If your mother needs additional diagnostic tests, referral to a Marshfield Clinic 
specialist, or a follow-up visit with her family physician, she has access to all of 
those services at our Regional Medical Centers. Details of her emergency room visit 
will be available immediately to all of the providers on campus and throughout the 
Marshfield Clinic System. This promotes communication about her condition, and 
minimizes the need to repeat studies. 

In order to assist with our quality performance, the Clinic developed a comprehen- 
sive package of initiatives that leverage the electronic technologies to redesign care 
for chronically ill patients, to identify improvement opportunities, collect needed in- 
formation at the point of care, and report performance hack to physicians. 

For example, our PreServ (Preventive Services) System is able to alert physicians 
when preventative services are due for a patient during a visit with a primary care 
manager. In PreServ, the EMR generates a preventive services (PRESERV) list on 
the dashboard of each electronic patient record. This box compares the patient’s clin- 
ical profile with evidence-based clinical practice guidelines formed from a number 
of sources including the ADA and input from endocrinologists at Marshfield, and 
highlights (in red) gaps in care related to preventive services, immunizations, rou- 
tine screening, and diabetes care needs; eventually, this functionality will be ex- 
panded to cover additional disease states. The system prompts the physician to pro- 
vide or schedule needed preventive services during the patient visit. In contrast to 
disease-specific programs and care registries, this list allows physicians to 
proactively plan and coordinate needed preventive, screening, treatment, moni- 
toring, and education across a spectrum of diseases for each individual patient. 

Our EMR also includes a system for flagging high-priority patients. A “hier- 
archical defect recovery list,” which acts as a safety net, includes high-risk patients 
with multiple chronic conditions that are in need of immediate attention. High-risk 
patients with serious gaps in care (e.g., diabetes patients who have not made ap- 
pointments for annual eye and foot examinations and whose hemoglobin Ale level 
is above goal) appear at the top of the list; physicians and staff use this list to work 
with the patient to provide or schedule needed care immediately. When a diabetic 
patient visits a physician for example, he or she is notified of the need to conduct 
a foot exam. Physicians are then provided “Clinical Storyboards” showing their per- 
formance with selected quality measures such as foot exam compliance. Since start- 
ing to measure and report these key quality areas, we have seen increases in per- 
centage of patients at goals, that are specified in public reporting and efforts such 
as the PGP Demo, for key areas such as hypertension, diabetes, congestive heart 
failure, and coronary artery disease. 

We have also implemented an anticoagulation care management system. All pa- 
tients who take the drug, Warfarin, which is a high-risk medication with a narrow 
therapeutic threshold, are managed under a single set of protocols. Under this 
nurse-managed, physician-directed telephonic management program, nurses place 
outbound calls to patients to discuss their anticoagulation management and check 
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on their general health. As needed, nurses adjust dosing based on written protocols 
and enter updates into the EMR. 

The Clinic has also implemented electronic prescribing to enhance safety. Physi- 
cians use tablet PCs for electronic prescribing, with prescriptions printed by com- 
puter, thus reducing the potential for medication errors. 

We have implemented a 24-hour nurse line. Patients have access to a 24-hour 
telephone number staffed by nurses. Nurses listen to the patient’s concerns, refer 
to the EMR for background data and care plan, offer advice, and triage patients for 
physician appointments using physician-approved guidelines. An automated e-mail 
system notifies physicians whose patients have called the nurseline and provides a 
hyperlink to the patient’s medical record. 

The Clinic is also utilizing the system to facilitate ongoing quality improvement 
efforts including continuing medical education, online provision of care guidelines, 
feedback and education by quality improvement medical directors and clinical nurse 
specialists, and sharing of comparative data on performance and best practices. The 
EMR facilitates many of these efforts by allowing physicians to collect data on qual- 
ity thereby providing timely, actionable feedback on individual performance. 

A key component of the CMS demonstration project was to show an overall de- 
crease in cost in comparison to other regional healthcare providers. Marshfield Clin- 
ic was one of only two practices to accomplish this. One way we leveraged our infor- 
mation systems to help reduce costs and hospitalizations was to identify patients 
who are not well managed in one or more critical quality areas. To address this 
problem Marshfield Clinic developed a software tool called “iList” (Intervention 
List), which is used in primary care including Internal Medicine, Med-Peds and 
Family Practice departments. iList originates from the electronic medical record and 
provides a list by provider of patients who have one of three chronic illnesses — dia- 
betes, heart failure or hypertension — and who do not meet all of their recommended 
health goals. iList is a tracking tool intended to help providers identify and reach 
out to patients who are overdue for services and are not meeting their quality of 
care goals. iList proactively assures that our patients get the care they need to try 
to help provide better control of their chronic medical conditions. Our physicians 
and their assistants use iList to be sure patients, especially those with diabetes, 
have lab work and follow-up visits when needed. In the past, patients might not 
have understood they needed to come in more frequently because they have diabe- 
tes. iList is a highly sophisticated reminder system, and can help physicians exam- 
ine their practices realistically and take action to improve care where there may be 
gaps. Our physicians have found that using it has been an eye-opener as far as put- 
ting a face on those patients who could be slipping through the cracks. Physicians 
are typically trained to take care of an individual patient and are not typically 
trained in the management of populations of patients. Using tools such as iList have 
allowed us to improve our performance on the quality metrics reported and more 
importantly the health of our patients as evidenced by decreased hospitalizations in 
some chronic conditions. For Marshfield Clinic to be competitive on the basis of re- 
sults, we need to know what our results are. This helps bring results to a patient 
level and lets us know where we stand on quality measures. 

iList is not a registry. Patients who are on target for their health goals do not 
appear on iList and it is not a registry of all of a provider’s patients or a listing 
of all patients with a specific condition. Only patients who have not achieved a spe- 
cific quality measure or who don’t have a future appointment will show up at any 
given time, and once they meet their goals they are removed from the list. iList may 
be viewed as being a subset of a registry, which would include all of a provider’s 
patient population. The patients listed on iList are patients not on target for their 
monitored quality health metrics. 

Provider-approved protocols make iList unique. Key to understanding iList’s po- 
tential, and part of what makes it different from other Information Systems tools, 
is provider-approved protocols built to accompany the application. The step-by-step 
written protocols — derived from evidence-based medicine in the Marshfield Clinic 
guidelines for hypertension, heart failure and diabetes — delegate interventions and 
actions to be carried out by medical assistants and other support staff. 

The protocols may be used as part of a patient-specific plan of care from the pa- 
tient’s primary care provider. With protocols providing direction, support staff may 
review the list and initiate actions to help patients reach their goals. Per protocol, 
for example, support staff may call a diabetic patient to schedule an overdue fasting 
lipid panel or foot exam. This promotes a team-based approach in the patient care 
process. 

iList exclusions — Certain patients with chronic conditions may be excluded from 
the iList application by the provider for reasons such as advanced age, terminal ill- 
ness or contraindications to the usual care. This ability allows the iList application 
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to individualize care for patients while considering population based measures for 
quality. 

Potential to track other conditions 

Development of iList was hastened due to Marshfield Clinic’s participation in the 
Centers for Medicare and Medicaid Services (CMS) Physician Group Practice Dem- 
onstration project which began in 2004. In order to improve our performance in the 
demonstration, our providers wanted the ability to look more closely at overdue 
services for patients with the three chronic conditions previously mentioned. 

Implementation of iList may provide the opportunity to address the way care 
teams handle planned care workflows. Planned care visits allow for results to be 
available at the time of a patient’s visit to allow direct immediate direction and 
changes to the patient’s care plan. This immediacy decreases the need for repeat 
visits and decreases rework (letters, telephone calls for communication of results) 
and for the patient and the practice after the visit. iList makes it easier to provide 
support to practices to help plan care for patients. This tool takes a huge step in 
that direction. 

The Clinic has also developed additional reporting mechanisms to identify pa- 
tients at risk of hospitalization (for example, congestive heart failure patients) who 
qualify to be added to the disease-management program. Once a patient is identified 
through criteria-driven data-mining, Care-Management staff review the patient’s 
electronic chart and make a determination if the patient meets criteria to be added 
to the disease-management system. This system provides a worklist and documenta- 
tion capabilities for the clinical staff to monitor at-risk patient populations, and es- 
calate a patient’s condition to a physician if required. 

While most of the groups participating in the CMS PGP program also have elec- 
tronic medical record systems, Marshfield Clinic is unique in that it has developed 
its own systems and data warehouse. This has allowed the group to customize its 
software as required and react quickly to meet reporting needs. We went through 
the typical quality reporting progression: denial that the results are accurate, im- 
provements to data collection, improvement in acceptance of the results, improve- 
ments in process and outcomes resulting in clinicians wanting more data, faster. Be- 
cause we have developed our own systems and data warehouse, we are able to react 
quickly and fine-tune as required to continually improve our data accuracy and 
timeliness. 

Recently, Ministry Health Care, the predominant hospital provider in the 
Marshfield Clinic service area agreed to use CattailsMD, an electronic medical 
record software suite developed by Marshfield Clinic, in most of its hospitals and 
Ministry Medical Group. 

The agreement will create the largest patient database in Wisconsin. Under the 
agreement, more than 1,000 providers in the Marshfield Clinic system, at Ministry 
Medical Group and Ministry hospital locations, will share access to 2.5 million pa- 
tient records. 

The implementation of Cattails within Ministry Health Care will take place over 
3 to 5 years. CattailsMD, now used by more than 13,000 healthcare providers, is 
the first provider-developed ambulatory electronic medical record to achieve Certifi- 
cation Commission for Healthcare Information Technology certification. 

With CattailsMD, caregivers will have immediate access to all patient medical in- 
formation, including lab results and radiology images, over their computers — no 
matter where they are located. The electronic records provide care and security ad- 
vantages over paper charts that must either be retrieved from a central storage area 
or be physically taken from one location to another within a healthcare system. 

As part of the CattailsMD implementation, Marshfield Clinic will provide plan- 
ning, project management, training, and technical support to Ministry Health Care. 
From a technology standpoint, the CattailsMD system stood out because its physi- 
cians liked the tablet platform and had witnessed its success at one Ministry health 
clinic. Physicians like the CattailsMD system because it’s delivered as a service 
where Marshfield Clinic hosts the data and manages the applications. 

Marshfield Clinic has a very mature data warehouse infrastructure and a world- 
class bioinformatics research group. Some organizations have gone through very ex- 
pensive and time-consuming EMR implementation efforts, but when they were done, 
they still had nothing in terms of data warehousing and the tools they need to man- 
age clinical outcomes. Ministry’s goal was to be proactive and take advantage of the 
benefits evident in the EHR as seen in the Marshfield Clinic system of care. Rather 
than wait for the patient to show up in the examination room, with CattailsMD 
their providers will be able to see which diabetic patients, for example, are overdue 
for their eye or foot exam screenings. 
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Diabetes mellitus is a rapidly increasing and costly public health problem. Large 
studies are needed to understand the complex gene-environment interactions that 
lead to diabetes and its complications. The Marshfield Clinic Personalized Medicine 
Research Project (PMRP) represents one of the largest population-based DNA 
biobanks in the United States. As part of an effort to begin phenotyping common 
diseases within the PMRP, we have reported on the construction of a diabetes case- 
finding algorithm using electronic medical record data from adult subjects aged 50 
years living in one of the target PMRP ZIP codes. Based upon diabetic diagnostic 
codes alone, Clinic scientists observed a false positive case rate ranging from 3.0% 
(in subjects with the highest glycosylated hemoglobin values) to 44.4% (in subjects 
with the lowest glycosylated hemoglobin values). They developed an improved case 
finding algorithm that utilizes diabetic diagnostic codes in combination with clinical 
laboratory data and medication history. This algorithm yielded an estimated preva- 
lence of 24.2% for diabetes mellitus in adult subjects aged 50 years. 

Marshfield Clinic has also embarked on a novel project to match genetic informa- 
tion from Alzheimer’s patients with environmental factors that may contribute to 
the disease. The 2-year project is the first to tap the more than 18,000 DNA samples 
Marshfield Clinic has gathered for its Personalized Medicine Research Project, one 
of the nation’s largest bio-banking efforts. Capitalizing on Marshfield’s extensive 
database of electronic medical records, the project aims to develop a set of genetic 
markers that would allow doctors to screen a person early in life to determine their 
risk for the disease. 

The study will focus on four specific genes and their connection to the disease. 
In addition to the patient’s DNA, we have a complete medical record. We know the 
medications they have been taking and what diseases they have been diagnosed for. 
We have also some environmental factors. Consequently we can perform genetic 
analysis and look at genes and the DNA with the phenotypes we have. No other 
projects to date has made that critical phenotype-genotype link that is the subject 
of this Alzheimer’s project within the Marshfield Clinic Personalized Medicine Re- 
search Project. The study is focusing on patients who are at least 70. Researchers 
will study 150 people who have Alzheimer’s disease and about 300 people who do 
not. They will be re-contacting people they believe do not have Alzheimer’s to con- 
firm that, doing what are called mini mental exams, basically short lists of ques- 
tions that are commonly used in clinical settings to confirm that the person truly 
does not have the disease. The project will also include a study of statins, which 
are one of the most commonly used medications to lower cholesterol and may actu- 
ally protect a person from developing Alzheimer’s. The project also will study the 
effects of smoking on the brain. 

Protecting Privacy and the Security of Health Information 

Marshfield Clinic has long been a proponent of HIT implementation, and federal 
policy reforms that would enable broad proliferation of an IT infrastructure nec- 
essary to sustain and improve the quality of health care services. The Clinic’s elec- 
tronic medical record is an essential tool for patient care that our physicians and 
care providers have utilized in the CMS Physician Group Practice Demonstration 
to identify sick and chronically ill patients and assure that they receive necessary 
primary and preventive services in a timely manner to avoid intensive specialty pro- 
cedures and hospitalizations. We strongly recommend that Congress provide incen- 
tives for the utilization of HIT and care management systems that add value to pa- 
tient care. We urge you to structure incentives in the Medicare program to hasten 
the objective of broad proliferation of HIT throughout the medical community. We 
have concerns, however, about proposed legislation that would change the current 
Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security 
Rules that strike a necessary balance between protecting the privacy and sanctity 
of a patient’s medical information and ensuring that necessary information is avail- 
able for vital health care functions. 

On many levels we believe that H.R. 6357, the “Protecting Records, Optimizing 
Treatment and Easing Communications through Health Care Technology Act of 
2008” is important legislation that offers incremental improvements to the policy 
landscape regarding the promotion of Health Information Technology and the pro- 
tection of patient’s personal health information. We have concerns, however, about 
several provisions of the legislation. We are concerned that this bill will increase 
the costs of providing health care and the cost of implementing electronic medical 
records without any measurement of the problem it is trying to solve. 

H.R. 6357 codifies ONCHIT, provides grants and loans for HIT, but most impor- 
tantly the bill creates new privacy and security provisions which require notification 
of breaches of PHI by covered entities and business associates. The bill also includes 
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restrictions on certain disclosures of PHI allowing patients to request that their in- 
formation not be released to health plans in certain circumstances. 

Currently the HIPAA Privacy Rule permits providers and health plans that re- 
ceive protected health information from a patient to share that patient’s information 
with other providers/health plans for treatment purposes without the patient’s au- 
thorization. In addition, covered entities can share with others the minimum 
amount of such information necessary for payment and for the entity’s operations, 
such as quality improvement activities. Beyond that, authorization from a patient 
must be secured before sharing the patient’s information. The Privacy Rule requires 
that health care providers and health plans use the minimum necessary amount of 
personal health information to treat patients and pay for care by relying on patients’ 
“implied consent” for treatment, payment of claims, and other essential healthcare 
operations. This model has served patients well by ensuring quick and appropriate 
access to medical care, especially in emergency situations where the patient may be 
unable to give written consent. For all other types of uses and disclosures, including 
for marketing purposes, covered entities must obtain prior written consent. 

The PROTECHT Act requires covered entities to make a reasonable effort to re- 
strict the use, disclosure, or request of PHI to a “limited data set” of information 
as defined in regulation. If the limited data set is insufficient, the covered entity 
must restrict the use, disclosure, or request of PHI to the minimum necessary to 
achieve the purpose. The PROTECHT Act encourages the use of “the limited data 
set,” which strips identifiers such as the name, medical record numbers, images, bio- 
metric identifiers and social security number of the patient. It also includes a new 
consent provision that requires additional patient consent if the PHI is utilized in 
operations, such as peer review, quality review, standard of care review, malpractice 
review, or best practices analysis. 

The requirements for a “limited data set” could be particularly onerous because 
it is impossible to know in advance what information is needed for most services. 
The “minimum necessary to achieve the purpose” makes it cumbersome to evaluate 
unexpected findings that were not anticipated. The question arises: Who will make 
this determination and at what cost? Consultations could become 20% opinions rath- 
er than second opinions based on a keyhole view of the potentially relevant data. 
The size of the keyhole will be limited by the imagination of the sender and will 
likely force duplication of effort by the receiver. The requirement to track releases 
between covered entities could inhibit the willingness of entities without advanced 
computer systems to share patient information. It is in the nature of free text that 
any given note will be a mixture of information, some relevant and some not; and 
the same could be said of many laboratory tests. Should we be required to black 
out items that someone doesn’t think are useful? Who will provide this censorship 
service? Are we to make separate requests for information for different specialists 
seeing the same patient? Will this curtail the use of shared electronic medical 
records among entities? 

We are also concerned about additional patient consent if the PHI is utilized in 
health care operations, such as utilization review or best practices analysis. This will 
be an obstacle for quality improvement. Although the bill may be referring to “out- 
side” review, the problem with “outside” is intractable, because almost all of our pa- 
tients are hospitalized “outside” of the Marshfield Clinic at the hospitals where our 
physicians have admitting privileges. This will complicate collaborative efforts be- 
tween the Clinic and the hospitals for quality improvement. 

Section 312: This section would prohibit the Clinic from sharing PHI about a spe- 
cific service with a patient’s insurance company, if a patient elected to pay cash and 
not submit the service for payment by the insurance company. This may be difficult 
in an electronic medical record setting as the bill would require that medical records 
be segregated so that medical records for cash services are never sent to or viewed 
by the insurance company. At Marshfield Clinic, patient medical records are often 
sent electronically to third party payors and at times, payors may be granted elec- 
tronic access to certain patient medical records as necessary to process claims. If 
H.R. 6357 were enacted, we would have to institute additional processes to seg- 
regate electronic medical records for services that are billable to the insurance com- 
pany and those that the patient elects to pay cash for so that certain records are 
neither sent to the insurance company whether electronically or via paper. The Clin- 
ic will also need to ensure that the insurance company is never given electronic ac- 
cess to the electronic medical records for such health care that was not reimbursed 
by the insurance company. This may also negatively impact a health plan’s ability 
to monitor the health of its enrollees and to offer preventive care services, as there 
will be gaps in data that is provided to the insurance company about health care 
that has been provided to their enrollees. 
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Requiring an accounting of disclosures for all disclosures of PHI, including for 
treatment, payment, and healthcare operations will be difficult. We currently do not 
log all these disclosures and it would be difficult to capture all since many times 
records are released directly by providers for treatment purposes, the billing office for 
payment etc. These disclosures are not logged or accounted for — as the law does not 
currently require this. In order to log all these disclosures, it is likely that any and 
all requests for PHI would have to be handled by our Health Information Manage- 
ment department and our release of info staff. This requirement could add 10-30% 
to the cost of implementing a robust EMR. 

Requiring patient consent before a disclosure can be made for health care oper- 
ations in an electronic medical record would likely require that each patient whose 
PHI is in the EMR sign such a release in advance. Each of health care providers 
who participate in the Clinic’s shared electronic medical record have access to all 
the PHI contained in the electronic record, therefore they can use the PHI as nec- 
essary for treatment, payment, healthcare operations without notifying the other 
providers whose medical records are being accessed in the shared EMR. So long as 
there is a shared patient relationship, such access is currently permissible under 
HIPAA without the patient’s authorization. In addition, the Clinic routinely uses its 
own medical records for healthcare operations such as quality review, peer review, 
malpractice claims handling, risk management, etc. It would be burdensome to ob- 
tain patient authorization each time their record was accessed for such purposes. 
Many patients would object and thus the records could not be used for these impor- 
tant health care purposes. 

The proposed HIPAA privacy rule was first published on November 3, 1999. Dur- 
ing the rulemaking process, the proper role for consent was carefully debated and 
considered. After drawing more than 50,000 comments from interested parties, the 
modified final version of the privacy rule was published August 14, 2002. During 
this time, requiring providers to obtain consent to use and disclose protected health 
information for treatment, payment and health care operations specifically was re- 
jected based on the comments that HHS received. The “most troubling” and preva- 
lent concern, based on their assessment, was that “health care providers would not 
have been able to use or disclose protected health information . . . prior to their ini- 
tial face-to-face contact with the patient, something which is routinely done today 
to provide patients with timely access to quality health care.” 

What is considered a “health care operation” under the HIPAA Privacy Rule? 

As defined by the privacy rule, health care operations includes the following ac- 
tivities: 

• Conducting quality assessment and improvement activities, including: out- 
comes evaluation and the development of clinical guidelines; population-based 
activities to improve health or reduce costs, such as infection surveillance or 
sentinel event root cause analysis; participation in quality reporting, such as 
to Joint Commission or the Reporting Hospital Quality Data for Annual Pay- 
ment Update (RHQDAPU) initiative; protocol development; case management 
and care coordination; contacting providers and patients with information re- 
garding treatment alternatives; 

• Reviewing competence of health care professionals, including: practitioner and 
health plan performance evaluation; training programs for health and non- 
health care professionals; accreditation, certification, or licensing. 

• Conducting or arranging for medical review or auditing functions such as 
fraud and abuse detection and HIPAA compliance programs. 

• Business management and general administration, including: formulary de- 
velopment and administration; development or improvement of methods of 
payment or coverage policies; customer service activities; creating de-identi- 
fied health information for purposes of research. 

In order to achieve the potential benefits of health information technology (HIT), 
providers and other entities must be able to use it as a tool to improve the quality 
and efficiency of health care delivery. For example, greater adoption of HIT could 
improve the management of chronic disease through better coordination of care and 
the development of best practices. However, generating the processes and protocols 
to make this a reality will require providers to conduct activities, such as analyses 
of data collected via HIT, considered health care operations under the Rule. Requir- 
ing consent for these types of essential activities would severely hinder these types 
of crucial functions needed to reap the much-touted advantages of HIT. 

For other types of uses, such as for population-based activities aimed at outcomes 
improvement or participation in quality reporting programs, requiring consent 
would prevent entities from securing the needed-threshold for meaningful success. 
For example, creating de-identified or limited data sets for the purposes of research 
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requires that the population on which it is based meet critical parameters that could 
be difficult to meet if it omits certain categories of patients. In the most serious in- 
stances, providers could be penalized significantly for failing to obtain affirmative 
consent for some types of operations. For instance, hospitals that could not obtain 
consent to use patient information for the purpose of reporting on quality measures 
for participation in the RHQDAPU initiative would receive a reduction of two per- 
centage points in their Medicare annual payment update. 

For these reasons, even proposed provisions that would require only a one-time 
or “blanket” consent for uses or disclosures of information for health care operations, 
would become unworkable in practice. A failure to obtain consent from even a frac- 
tion of a given population would preclude providers and other covered entities from 
conducting essential quality improvement and research functions. Likewise, provi- 
sions that would allow an individual to retract consent would impose an additional 
layer of burden by requiring covered entities to track information that was pre- 
viously used or disclosed and retroactively remove the effects of various trans- 
missions. 

Summary 

It is extremely important that legislation focused on the adoption and use of safe 
and secure electronic health information systems be adopted as soon as possible, as 
such systems will be the foundation for essential improvements in quality and ac- 
cess to care, movement in the direction of evidence-based medicine, expanded access, 
and value-based purchasing. A robust HIT system enhances physicians’ ability to 
take care of populations of patients without losing sight of the individual needs of 
patients. It is important, however, to keep in mind that change in a culture of au- 
tonomy takes time. The use of an electronic health record is necessary but not suffi- 
cient to affect change. 

There is no question that HIT is expensive, and perhaps cost-prohibitive. Physi- 
cians and providers are expected to pay for it, funding and maintaining the infra- 
structure of systems that utilize population-based information to improve patient 
health. There is a very small return on the investment in HIT to the physician, 
which is a return in efficiency and time. The significant benefits accrue to the pa- 
tient and the payor, whether it be employers or the government. If Congress man- 
dates changes such as imposing restrictions on the utilization of patient information 
for operations as proposed in H.R. 6357, we estimate that the cost of HIT will in- 
crease dramatically, undermining the return on investment that should accrue to 
patients and payors. 

We would like to acknowledge the contribution that Dr. Peter Orszag and the 
Congressional Budget Office have made in calling attention to the research in vari- 
ations in treatment and outcomes conducted at the Dartmouth Medical School under 
the guidance of Drs. Jack Wennberg and Elliott Fisher. Considering the rapid ex- 
pansion of new medical knowledge occurring today, it might be reasonable to expect 
this continuing variability in care. The accelerating growth in new medical knowl- 
edge, coupled with the birth of new sciences, such as genomics and personalized 
medicine, suggests that physicians, nurses, and other health care professionals will 
invariably continue to fall further and further behind in their ability to keep up 
with the latest discoveries and approved treatments. As information technology has 
sparked this explosive growth in knowledge, only information technology can pro- 
vide an adequate response. By using evidence-based knowledge embedded in clinical 
decision support deployed within a well-designed workflow, physicians can manage 
the ever changing and growing knowledge base critical to the delivery of effective 
and efficient healthcare. 

Health IT on a broad basis is still in its infancy. Health care organizations have 
not developed IT to its full potential. Current costs may seem too high for what we 
are getting in return. Looking at what our costs today are is not the point. Start 
up costs will always be high. Looking to what can be achieved in the future due 
to implementation of these systems should be our focus. 


Mr. CAMP. With the debate over health IT moving forward, 
there has been considerable attention placed on privacy and secu- 
rity. I agree that we must consider these important issues, and we 
must be cautious, however, that in a desire to complete an HIT bill, 
any HIT bill, that we do not limit the ability of health care workers 
and facilities to actually provide the proper health care. 
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Congress must encourage providers to make this transformation, 
not over-burden them with a new, unworkable set of regulations. 
At the risk of taking a well-known phrase, the remedy cannot be 
worse than the disease. 

Earlier this week I read that the Chairman hopes to introduce 
a health IT bill in coming weeks. I sincerely hope that the Chair- 
man will accept my offer to work in a bipartisan manner, just as 
the Energy and Commerce Committee is doing on health IT legisla- 
tion. It is an important issue. With that, I yield back the balance 
of my time. 

Chairman STARK. Thank you, Mr. Camp. At this point, we will 
proceed with our panel. It will be led off by Dr. Peter Orszag, who 
is the director of the Congressional Budget Office, with whom we 
constantly battle over numbers and procedures. 

I warn the rest of the witnesses, he used electronic prescribing 
to get a gallon’s worth of high-test caffeine in front of him instead 
of water, so he should be ready to really zero in on us. 

I am going to ask Dr. Yul Ejnes, who is the Chairman of the 
medical services Committee of the American College of Physicians; 
Ms. Deven McGraw, who is the director of the Health Privacy 
Project at the Center for Democracy and Technology; Dr. Matthew 
King, who is the chief medical officer at Clinica Adelante, Incor- 
porated, of Surprise, Arizona; Mr. LeRoy Jones, of GSI Health of 
Philadelphia, Pennsylvania; and Mr. David Whitlinger, director of 
healthcare device standards and interoperability at the Intel Cor- 
poration will lead off, and ask each of the witnesses to summarize 
or expand on their written testimony in any manner that they are 
comfortable. Then we will let the panel expand through questions. 

Dr. Orszag, would you like to lead off? 

STATEMENT OF PETER R. ORSZAG, PH.D., DIRECTOR, 
CONGRESSIONAL BUDGET OFFICE 

Mr. ORSZAG. Mr. Stark, Mr. Camp, Members of the Committee, 
I guess I will hope to escape this battle without too much carnage, 
with the defense of my caffeine. But let me try to focus in on what 
I consider to be the largest inefficiency in the economy, which is 
our health care system. 

Credible estimates suggest that as much as $700 billion a year 
in health care services are delivered that do not improve health 
outcomes. That is 5 percent of GDP, 30 percent of what we spend 
on health care, $700 billion. That number comes from a variety of 
calculations, including the very substantial variation that we see 
across the United States in the intensity of services provided with- 
out any corresponding benefit, in terms of the quality or outcomes 
that result from the higher spending regions. 

It is striking, for example, that among Medicare beneficiaries in 
the last six months of life who are treated at UCLA Medical Cen- 
ter, the average cost is roughly $50,000 a year. Among those bene- 
ficiaries in the last 6 months of life who are treated at the Mayo 
Clinic, the average cost is about $26,000 a year. 

I cannot tell you — and I don’t believe that there is a person in 
this country who can tell you — what we are getting in exchange for 
the extra money at UCLA Medical Center. So, why is this hap- 
pening? 
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I think there are a variety of explanations. But technology and 
incentives are among the most important. Let’s start with incen- 
tives. We have incentives for more care, rather than better care. 
Guess what? We wind up with more care. But in order to alter that 
system of incentives, we need to know what better care is. That 
brings me to the second point, which is that we need more informa- 
tion on what works and what doesn’t, specifically at the clinical 
level. That will require a very much expanded set of health infor- 
mation technology. 

So, one can think of health information technology as the founda- 
tion or the gateway to capturing that $700 billion opportunity. It 
will not be sufficient by itself, but it is necessary to put in place 
a more universal system of health information technology in order 
to capture the opportunities that we have before us. I would em- 
phasize I think this is, by far, not even close, the most important 
fiscal question that we face: improving the efficiency of the nation’s 
health system. 

So, how do we do that? There are a variety of approaches, and 
I am going to leave to my fellow panelists the important questions 
surrounding privacy, security, interoperability, and just focus in on, 
assuming that we can come up with acceptable answers to those 
questions, how do we spur adoption? Because as you have already 
noted, only 10 to 20 percent of providers have such systems. 

Basically, there is either the carrot or the stick. The carrot could 
take the form of a bonus or a tax incentive for adoption. That can 
help to increase adoption among providers. But, typically, policy 
makers want to limit the budget costs involved, and typically, the 
subsidy is, therefore, pretty small. What you are, therefore, doing, 
is only affecting those entities that were close to adopting volun- 
tarily. 

So, a provider or a doctor or a hospital will look at the cost of 
putting in the system, and then the benefits to the doctor or the 
hospital, and adopt if they think it’s beneficial, and not, if not. 
What you’re doing is only pushing over the line those folks who 
were close anyway, with a modest subsidy. Plus, you’re buying out 
the base, or providing a subsidy to all the entities that would have 
adopted anyway. 

So, in general, a subsidy approach, unless you’re going to spend 
lots and lots of money, is not going to affect that many people, and 
it’s not that cost effective, because you’re going to be buying out 
some people who would have done it anyway. 

The alternative is a stick. The stick would take the form of the 
Federal Government saying you have three or four — some years, or 
some period of time to adopt a health IT system that meets the fol- 
lowing standards, or meets the standards set by a public-private 
partnership. If you have not done so, you would not be reimbursed 
under Medicare or Medicaid. 

I will say, very bluntly, that if we want to get to universal or 
nearly universal health IT in the very near term at reasonable 
budget cost, I do not see an alternative to the stick. One can com- 
bine these two approaches, like you did in the prescribing piece of 
the legislation that you’ve recently adopted, and provided a subsidy 
for some period of time, and then a penalty thereafter. 
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I will note that CBO did score a $2 billion savings to the e-pre- 
scribing provision in the recent Medicare legislation, both because 
we assumed, or we projected that it would lead to increased take- 
up of generic drugs, but also because there would be some penalties 
imposed, the point being that, if done right, and done in the right 
structure, health IT can save money. 

On a broader basis, I would just say again, coming back to the 
main point, it’s necessary but not sufficient. You also need changes 
in incentives and comparative effectiveness. But it is a foundation, 
and the gateway or the key to capturing that $700 billion oppor- 
tunity, and we could get there with a combination of carrots and 
sticks. Thank you very much. 

[The prepared statement of Mr. Orszag follows:] 
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Note 


This statement reprises the Congressional Budget Office’s May 2008 report Enina ok tlx Costs ed Brnfits 
oflhSInjomm Ttekdog 






Chairman Stark, Mr. Camp, and Members of the Sub- 
committee, I am pleased to appear before you today to 
discuss the costs and benefits of health information tech- 
nolog)' (health IT). Information plays a key role in health 
care. Providers such as physicians and hospitals generate 
and process information as they provide care to patients. 
Managing that information and using it productively 
pose a continuing challenge, particularly in light of the 
complexity of the U.S. health care sector, with its many 
different types of providers, services, and settings for care. 
Health IT has the potential to significantly increase the 
efficiency of the health sector by helping providers man- 
age information. It could also improve the quality of 
health care and, ultimately, the outcomes of that care for 
patients. 

Introduction and Summary 

The term “health IT" generally refers to computer appli- 
cations for the practice of medicine. Those applications 
may include computerized entry systems for physicians' 
ordering of tests or medications, support systems for clin- 
ical decisionmaking, and electronic prescribing of medi- 
cations. (The appendix provides more information about 
the different types of health IT and the terminology used 
in the fidd.) Some or all of those components arc housed 
in the dectronic medical record (EMR). The electronic 
health record (EHR) is the primary health IT package 
commonly purchased by a provider. It is an EMR with 
the capacity to send and receive data electronically and 
meets the requirements for interoperability. 1 

When used effectively, EHRs can enable providers to 
deliver health care more efficiently. For example, the) 1 
can: 
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>sts and Benefits of 
tion Technology 


■ Eliminate the use of medical transcription and allow a 
physician to enter notes about a patients condition 
and care directly into a computerized record;" 

■ Eliminate or substantially reduce the need to physi- 
cally pull medical charts from office files for patients’ 
visits; 

■ Prompt providers to prescribe generic medicines 
instead of more costly brand-name drugs; and 

■ Reduce the duplication of diagnostic tests. 

The adoption and proper use of EHRs could also 

improve the quality of health care. Among other things, 

they could: 

■ Remind physicians about appropriate preventive care; 

■ Identify harmful drug interactions or possible allergic 
reactions to prescribed medicines, and 

■ Help physicians manage patients with complex 
chronic conditions. 


1 . Interoperability describes the capacity of one health IT applica- 
tion to share information with another in a computable format 
(that is, for example, not simply by sharing a PDF [portable docu- 
ment format] file). 

2. Many physicians use voice dictation to document and report the 
results of examinations and procedures. Medical transcription is. 
in its simplest sense, the process whereby those dictated notes 
about a patient s cate arc converted into a typewritten format. 


CBO 
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Box 1. 

The Office of the National Coordinator of Health Information 
Technology 


The Office of the National Coordinator of Health 
Information Technology (ONQ manages the federal 
government’s activities in two main areas: the devel- 
opment of standards necessary to achieve the inter- 
operability of the large number of varying applica- 
tions of health information technology (health IT) 
and the facilitation of information exchange. 

Dev eloping Standards to Ensure 
Interoperability 

To establish processes for identifying standards with 
which health IT systems must comply and lor certify- 
ing that the standards are being met. the Department 
of Health and Human Services (HHS), through 
ONG set up the Health Information Technology 
Standards Panel (H1TSP). The panel’s overarching 
task is to promote interoperability' in health care— 
the ability of systems and applications to communi- 
cate with each other. HHS also awarded a three-year 
contract to the Certification Commission for Health- 
care Information Technology (CCHIT) to develop 
and evaluate certification criteria and create an 
inspection process for health IT. 

As the standards process is currently set up, the 
H1TSP develops industrywide health IT standards 
and recommends them to the Secretary of Health and 
Human Services, who first “accepts’ them and then 
one year later officially “recognizes" them for use in 
federal health IT applications. (Such applications 
include those used by the federal government— for 


example, in the Veterans Health Administration— 
and bv federal contractors.) The panel uses the one- 
year period to refine the instructions given to vendors 
for complying with the standards. The standard-set- 
ting process is designed to minimize the number of 
unworkable standards that are issued rather than to 
maximize the speed with which standards are set. Pri- 
vate-sector health IT users are not required to comply 
with the federal standards; nevertheless, the federal 
standards have become the de facto industry measure 
for achieving interoperability. 

Health IT vendors who wish to have their products 
certified as compliant with new federal standards 
an submit those products for examination by 
CCHIT. Certified demonic health record products 
should be able to communiate and operate with 
other similarly certified systems. 

Facilitating Health Information Exchange 

To ease the electronic exchange of health-related 
information. HHS funded the creation of prototypes 
for organizing the components of the National 
Health Information Network (NHIN). ONC 
describes the NHIN as a “network of networks," 
built out of state and regional health information 
exchanges (and other networks) to link those various 
networks and the systems they in turn connect. The 
NHIN s mission is to develop a national capability to 
exchange standards-based health care data in a secure 
computer environment. 
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Many analysts and policymakers believe that health IT is 
a necessary ingredient for improving the efficiency and 
quality of health cart tn die United Stales. Despite the 
potential of health IT to increase efficiency and improve 
quality, though, my few providers— as of 2006. about 
1 2 percent of physicians and 1 1 percent of hospitals— 
hate adopted it.* An important question foe policy- 
makers. therefore, is whether— and if the answer is yes, 
how— the federal govetnmcnr should stimulate and guide 
the adoption of health IT. 

The Bush Administration has set the goal of making an 
EHR available for most Americans by 2014. In 20W. it 
established the position of the National Coordinator for 
Health Information Technology in the Department of 
Health and Human Services to help bring about the 
broad adoption of health IT Isa Box I ). Other federal 
agencies that finance health care or provide it directly 
have also uktn steps to encourage adoption or to use 
health IT in their own clinical operations. Proposals 
before the Coe^ress would expand the federal gornn- 
mem's current activities by, among other things, mandat- 
ing the use of some typo of health IT. such as electronic 
prescribing f e-prescribing’h offering financial incentives 
to preniden who use health IT: and increasing the funds 
available foe grams to purchase systems for providers. 

This Congressional Budget Office (CRO) analysis focuses 
on evidence about the benefits and costs of health IT and 
identifies and analyzes turners to its adoption. Research 
indicates that in certain settings, health IT appears to 
make it easier to reduce health spending if other steps in 
the broadet health care system are also taken to alter 
incentives to promote savings. By itself, the adoption of 
more health (1* is generally not sufficient to produce sig- 
nificant cost savings. 

The most auspicious examples involving health IT have 
tended to be connected to relatively integrated health sys- 
tems. For example. Kaiser Fctminemc is a large inte- 
grated ddhery system in which the health plan (primarily 
a health mainttnance organization, ot HMOj and the 
providers (physicians and most hospitals and auditin' 
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service providers) exclusively contract with one another 
to provide care to the health plans ctuolcts. For such a 
system, reducing the number of unnecessary office visits 
(for patients' concerns or issues that could be handled to 
their satisfaction through telephone or e-mail consulta- 
tions), for example, benefits the providers, the health 
plan, and the patients: It may lower the plans costs for 
providing health care— and thus improve its *bortoro 
line’— while minimizing inconvenience foe patients. Kai- 
ter has implemented a systemwide EHR in its facities in 
tome regions. In those areas, physicians have used such 
consultations to reduce the number of unnecessary office 
visits (compared with the number in regions without 
electronic systems), 

A number of integrated dchrety systems, including Intrr- 
mcunuin Healthcare. Granger Health System, and 
Partners HcalthCart. have also implemented FilRs 
across their organizations, and officials believe that as a 
result the systems have improved the efficiency and qual- 
ity of the care they provide.* Some integrated systems 
have worked with health IT foe decades. Intermountain 
Healthcare and the Department of Veterans Affirm (VA), 
foe example, both began using computers to help manage 
clinical data in the 1970s. The VA has successfully imple- 
mented a systemwide EHR in a health cart system that 
serves nearly 6 million patients in more dun 1,400 hos- 
pitals. dinks, and nursing homes (Department of Veter- 
ans .Affairs, 2008). According to the agency, its use of 
health IT has reduced its costs and greatly improved the 
quality of its cur. (A recent Congressional Budget Office 
report [2007a] discusses the VA system in greater detail.) 

For providers and hospitals (hat are not pan of integrated 
systems, however, the benefits of health rT are nor as easy 
to capture, and perhaps nor coincidentally, those physi- 
cians and facilities have adopted EHRs at a much slower 
rate. Office-based physicians in particular may set no 
benefit if they purchase such a product— and may even 
suffer financial form. Even though the use of health IT 
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could generate con sayings tor the health system at large 
that might offset the EHRs cost, many physicians might 
not be able to reduce that office expenses or increase 
their revenue sufficiently to par for h. 

For rumple, the use of health IT could reduce the num- 
ber of duplicated diagnostic tests. Hem ever, that 
improvement in efficiency would be unlikely to increase 
the income of many physicians because laboratories and 
imaging centers typically perform such tests and ore paid 
separately by health insurance plans. In coses in which a 
physician performs certain diagnostic tests in the office, 
reducing the number of duplicated tests would reduce has 
or her income. As a result, the capacity to avoid duplicat- 
ing tests might not spur many physicians to invest in and 
implement a health IT system. Indeed, physicians might 
have a more powerful financial incentive to purchase 
additional office diagnostic equipment, for rumple, than 
to purchase a health IT system. 

The search foe improved efficiency in (Warning health 
care has prompted numerous proposals for increasing the 
adoption of health IT. Two recent studies, ooe by the 
HAND Corporation and one by the Center for Informa- 
tion Technology leadership (GTL). have estimated that 
about $80 billion in net annual savings is potentially 
amibutable to such technology. Those studies have 
retched significant attention, bat fix a number of reasons 
they arc not an appropriate guide to estimating the effects 
of legislative proposals aimed at boosting the use of 
health IT. To take the RAND study os on example: 

I The RAND researchers attempted to measure the 
pttmil impact of widespread adoption of health 
rT— assuming the occurrence ofopproprate changes 
in health cart*— rather than the LUj impact, which 
would take account of factors that might impede its 
effective use. For example, health care financing and 
defiray arc now organized in such a way that the pay- 
ment methods of many private and public health 
insurers do not reward providers for reducing costs— 
and may even penalize them for doing ta 

■ The RAND study was hosed soWy on empirical stud- 
ies from the literature that found positive effects for 
the implementation of health IT systems: it eiduded 
the studies of health IT. even those published in pea- 
reviewed journals, that faded to find favorable results. 
The decision to ignore evidence of aero or negative net 


savings death' biases any estimate of the actual impact 
of health FT on spending. 

■ The RAND study was not intended to be on estimate 
of savings measured against the rates of adoption that 
would occur undo current law, bat ratha against the 
level of adoption in 2001. Hut is. the researchers did 
nor allow far growth in adoption races that would 
occur without any changes in policy, as CBO would 
do in a cost estimate fix a legislative proposal. 

One significant potential benefit of health IT that has 
thus far gone frfctbth unexansined involves its role in 
research on the comparative effectiveness of medical 
treatments and practices. Widespread use of health IT 
could make available large amounts of data on patients' 
are and health, which could be used for empirkal studies 
that might not only improve the quality of health care 
but also help make the delivery of services more efficient. 

By making dinical data easier to reflect and analyze, 
health IT systems redd support ripxous studies to com- 
pare the effectiveness and cost of different treatments for 
a given disease or condition, then, in response to the 
studies findings, they could aid in implementing changes 
in the kinds of care provided and the war those services 
were delivered, as well as track progress in carrying out 
the chaises. Sodt comparative effectiveness studies could 
lead to reductions in tool spending for health care 
because of the tendency in the current health cart system 
to adopt ever more expensive treatments despite the lock 
of solid evidence about their effeeth mess. The l&elihocd 
of such reductions in spending could be increased if the 
studies' findings were linked to the payments that 
providers received or the cast sharing that patients faced, 
ponkularly if sufficiently stria rosi-cffixtiventss thresh- 
olds were used (Coogrcssiotul Budget Office. 2007b). 

If the federal government chose to intervene directly to 
promote the use of health IT. it could do so by subsidiz- 
ing that use or by imposing a penalty for failing to use a 
health IT system. From a budgetary perspective, the sub- 
sidization approach is less likely than a penalty to gener- 
ate cost savings for the federal government because of the 
costs of the subsidies: Payments would end up going to 
those providen who would have adopted a health IT sys- 
tem even without a subsidy as well as those providen fix 
whom the subsidy made the difference in their decision 
to adopt one. However, providers may respond differen- 
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lolly to t subsidy or a penalty depending on how those 
interventions are presented. 

Evidence on the Adoption of Health 
Information Technology 

A wdl-funaioeing FHR — coenpcising clearonk docu- 
mentation of providers’ notes, clearonk viewing of labo- 
ratory and radiological results, c-prcscribinj. and an 
interoperable connection via a health information 
exchange with all other providers and hospitals in a com- 
munity— could base a significant impact on medical 
practice (jha and colleagues, 20061. For example, con- 
sider a physician without a health IT system. The physi- 
cian has a paper chan for each patient, and the follow ing 
steps may then be involved in the patients carr 

■ For each visit, the physician writes notes in the 
dun— or dictates them for later transcription— about 
tbe patient's condition and treatment. The nurse who 
takes the patient to the exam room records vital statis- 
tics (pulse, blood pressure, and temperature) in the 
paper chart. The physician writes out any needed pre- 
scriptions and gives them to the patient to fill at a 
pharmacy. If the chan coatains information on the 
patients allergies, the physician might check it to 
make sure the prescribed drug *i3 have no adverse 
effects. 

■ If the physician decides to refer the patient to a spe- 
cialist for a consultation, a portion of the patient's 
dun will go to that provider in tbe form of a letter. In 
many instances, however, the specialist does not 
receive a letter and has no information ocher than 
what might be noted in a referral form. The panent 
must then fill out a medical history and other forms 
required by the specialist. Moreover, unless the refer- 
ring physician includes results from recent lab and 
radiology procedures, the specialist may well otder 
similar diagnosis; rests. If the physicians are both pan 
of a multispeisalty medical group that sees patients in 
multiple locations, the entire medical chan may need 
to be ddivered to the specialist's office foe the visit, 
risking the loss of the chan. 

■ Following the patient's visit, the specialist sends a let- 
ter hack to the referring physician, detailing the results 
of the encounter. If the condition is serious, the spe- 
cialist will probably communicate by telephone. 


By contrast, consider a physician who uses an F.HR. In 

that case: 

■ The physician might use a ‘drop-and-dick’ menu to 
note some dements of the patient's condition, reduc- 
ing the need foe handwriting or dictation and elimi- 
nating the delay— typically at least a week— in getting 
the transcribed notes into the chart 

■ The EHR would automatically check any prescrip 
lions for errors in doting, allergies, and dn$ interac- 
tions: if the patient's health insurance plan tnduded a 
formulary (a let of prescription drugs appro, cd for 
use), tbe physician could discuss information about 
prices and copayments while the patient was still in 
the office. The EHR might also hast a feature that 
could suggest a drug that might be a better choke, 
given the specifics of the patients condition. The pre- 
scription would then be delivered dearonkalhr to the 
patient’s pharmacy. 

■ A referral to a specialist would also be handled dec- 
tromcalh. The dinical information necessary for the 
visit to the speciaiisi would be automatically transmit- 
ted to that office and would include the results of any 
diagnostic procedures that (hr referring physician had 
ordered, including digiriird images from radkdogkal 
procedures. 

I Following the consulutioci with the specialist, that 
physkians notes and recommendations would be elec- 
tronically transmitted hack to the referring physicians 
office, where they would become part of the patient's 
chan. Ideally, the EHR would substantially simplify 
operations in physicians' offices; it would haw a simi- 
lar if not a stronger impact in hospitals, given their 
more complicated care and treatment regimens. 

.As interest in health IT has grown, several surveys have 

attempted to measure current levels of ia adoption. 

■ A survey sponsored by the Roben Wood Johnson 
Foundation (and summarized in Jha and colleagues, 
2006) estimated that 24 percent of office-based physi- 
cians used an EHR of one type oe another.* 1 Physicians 
who worked in solo practices were less likeh to have a 
health IT system than were physicians who worked in 
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larger offices (adoption rates of 16 percent versus 
39 percent, fespeemdr). 

■ A 2006 survey of noofcdenl office-hosed physicians 
by the National Center for Health Statistics reported 
that 1 2.4 percent of them used a comprehensive 
health IT system, and an additional 16-8 percent said 
they used some type of system/ 1 

■ Anotherstudv, by the Center for Studying Health Sys- 
tem Change, compared rates of health II* adoption liar 
two periods: 2000 to 2001 and 20(M to 2003. The 
study found that adoption of health FT by large prac- 
tices continued to oceed adoption by smaller pne- 
tkes by as much as 38 percentage points (Grossman 
and Reed, 2006). 

The rates of adoption of EHRs by hospitals appear to 

be similar to those of physicians, according to recent 

analyses: 

■ Although the Robert Wood Johnson Foundation 
study mentioned above did not estimate the preva- 
lence of EHRs in hospitals (because the available evi- 
dence was too limited). it concluded that only 

5 percent of hospitals used compatcriicd physician 
order entry (CPOE) systems, which are a key compo- 
nent of hospital EHRs (Geoege Washington L’nmr- 
Htv. Massachusetts General Hospital, and Robert 
Wood Johnson Foundation, 2006). 

I That conclusion ts consistent with the findings of a 
2003 study by Cutler. Feldman, and Horwra. which 
found that 4 percent of hospitals were in foil compli- 
ance with standards foe CPOE, although an additional 
17 percent of hospitals had made progress toward 
obtaining the technology . The Order team concluded 
that hospitals' profitability was not associated with the 
use of CPOE— a possible reason for the low adoption 
rates. 
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■ A more recent survey by the America Hospaal .Asso- 
ciation. reponed in 2007, found that 1 1 percent of 
noftfedcral hospitals had fidly implemented EHRs. 
Such hospitals were more likdy to be large uthaa 
or teaching hospitals than to be small community 
facilities. 

Some international comparisons are available that mea- 
sure investment in health IT and other parameters, such 
as rates of adoption and the functionalities that imple- 
mented systems provide. That research suggests that the 
United States lags behind other Western countrio (spe- 
cifialy. the United Kingdom. Germany. Australia, the 
Netherlands, and New Zealand) although perhaps not 
dramatically, if the measure being used is the adoption of 
sophisticated IT systems. In several of those countries, 
rates of adoption of health IT systems among physicians 
arc mot above 80 percent (Schott and others. 2006). 
Although the data show that U.S. physicians arc for less 
likely than physkians in those countries to use EHRs in 
their offices, they arc just as or even more likely to use 
motc-sophistkatnl electronic functions— such as access- 
ing their patients' records remotely. That finding points 
to the difficulty of comparing rates of adoption— some 
countries may report high rates, but it is not dear 
whether their systems arc particularly sophbtiofoi or 
fitly utilized (Schocn and others. 2006). In most coun- 
tries in mhkh rates of adoption are high, the government 
has heavily subtidiied the acquisition of health IT sys- 
tems by providers (Anderson and others, 2006). 8 

Evidence on the Benefits of Adopting 
Health Information Technology 

No aspect of health IT entails as much uncertainty as the 
magnitude of its potential benefits. Some analysts behest 
that the adoption of such systems could provide substan- 
tial savings by lowering the cost of pioriding health cart, 
eliminating unnecessary health cart services (such as 
duplicate diagnostk rests), and improving the quality of 
cart in ways that might reduce costs (by diminishing the 
likelihood of adverse drug events, foe example). Other 
analysts cipect little Sea on costs but some improve* 
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mem in the quality of arc. Another school of though! 
holds that health IT could bolster the quality of cut but 
also increase expenditures on health arc services— 
because improvements in quality mould stimulate 
demand for additional services 

Wider adoption of health IT has the potential to generate 
both internal and external savings: 

■ Internal savings arc those that an be captured by the 
prouder or hospital that purchases the syseetn; they 
are most likely to be in the form of reductions in the 
cost of providing health cut — that is, improvements 
in the efficiency with which providers aid hospitals 
ddritrare. 

■ Enema! usings are those that the provider or hospital 
that purchases the system cannot realiae hut that 
accrue to another such provider or perhaps the rele- 
vant health insurance plan or even the patient. Such 
savings might arise, for example, from the newfound 
ability of participants in the health ate sector to 
exchange information more efficiently. 

For integrated systems {such as Kaiser IVrauneme and 
the VA), more savings air internal than would be the case 
foe providers (hat ate not part of an integrated system. 

For cumple. integrated systems often have contracts with 
health insurance plans emailing that the systems assume 
the financial risk for the cost of prescription drugs and 
di^nostic tests, among other thirds, for the patients cov- 
eted by those plans. As such, the systems can capture the 
savings from shilling their prescribing patterns toward 
generk drugs and reducing the number of duplicated 
diagnostic tests. 

Different reimbursement arrangements might abo shift 
savings from the cucrtul to the internal category in 
instances in which a provider is nor pan of an integrated 
system. A provider who was not affiliated with an inte- 
grated system bur who treated HMO patients might be 
similarly rewarded for appropriate formulary manage- 
ment, which would shift those savings from being atcr- 
tul to internal. But if the provider was paid purely on a 
fee-for -service bans, the savings would remain an ntcmal 
benefit. 

The extent to which the use of health IT generates sav - 
ings and bow those savings are distributed across the 
health are saw an greatly influence the speed of 


broader adoption and use of those technologies. If health 
IT* adoption primarily produced internal savings for the 
providers and hospitals that purchased the systems— 
that is, if the purchasers of the systems were able to cap- 
ture most of the cost savings that arose from using the 
technology— then the adoption of health IT would prob- 
ably proceed apace without any need for intervention by 
the federal government. Bat if health IT appeared prima- 
rily to provide extend savings— that u, if those who 
adopted the systems were unable to gamer a sizable share 
of ehc benefits— ehen the adoption of such systems might 
proceed very slowly without additional governmental 
support. 

Of the research to date, most studies examine how health 
IT might make the delivery of health care services more 
efficient, and they tend to focus on a particular clinical 
practice or area of potential savings. The evolving nature 
of the U.S. health are marketplace and of health IT has 
made it dilficult to apply (he results of such research to 
national estimates of the impart of health IT on the costs 
and quality of care. The few studies that have attempted 
to do so appear to hare substantial shortcomings that 
limit their usefulness in analyzing legislator proposals. 
And some poeentd areas of research and analysis remain 
largely itntxamined. They include the ways in which the 
ddritty of health are services might change in response 
to the efficiencies that health IT offers and how the large 
amounts of clinical data available through EHRs could 
contribute to analyses of the comparative effectiveness 
and coH-efifccrivtntss of different treatments. 

Underlying any consideration of the potential benefits of 
health IT are the financial incentivrs that influence the 
behavior of health care providers, hospitals, health insur- 
ance plans, and patients. The me of information technol- 
ogy might lead to greater efficiency in delivering health 
are and to higher-quahry services, but financial incoi- 
tries could constrain many of those positise changes. For 
example. EH Rs could provide physicians with a useful 
tool for reducing the number of unnecessary or dupli- 
cated laboratory tests that they ordered, but the likeli- 
hood of such reductions could depend on factors such as 
whether physicians were compensated for controlling the 
uk of laboratory testing (as in some managed are plans) 
ot whether they deristd income from ordering more 
tests. How well health IT fives up to its potential depends 
in part on how effectively financial incentives can be 
realigned to encourage the optimal uk of the technol- 
ogy's capabilities. 
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A general indication of health IT's uscfolncss in improv- 
ing efficiency and quality an be wen in ibe adoption of 
sods applications by integrated health arc defivtiv sys* 
terns (such as staff-model HMOs). By then nature, those 
typo of systems art able to gamer more of the benefits of 
health IT than noointegtated providers can Not surpris- 
ingly, such entities hast rdamtfr high rates of adoption 

of health rr. 

Estimates of die Potential National Savings from 
Widespread Adoption of Health IT 

Two studies, one hr the RAND Corporation and one by 
the Center for Information Tcthnolcgr Leadership, 
report estimates of the potential net benefits that could 
arise nationwide if all prattlers and hospitals adopted 
health information technology and used it appropriately. 
(For the RAND research, set Grosi. Meili. and ScoviOe. 
2005: and Hillestad and others. 2005. The QTL study is 
reported by Walker and colleagues. 2005. and Ran and 
others. 2004.1 Both studies estimated annual net savings 
to the health ate sectot of about $00 billion (in 2005 
dollars), relative to total spending for health care of about 
$2 trillion per sear. The studies, howtm, measured dif- 
ferent sources of such savings. The RAND research 
focused primarily on savings thitthe use of health IT 
could generate by reducing costs in physiaaivs' practices 
and hospitals, whereas the QTL study limited its scope 
to savings from achieving full interoperability of health 
IT. explicitly excluding potential improvements in effi- 
ciency within practices and hospitals. 

Neither the RAND nor the CITL study, however, is an 
appropriate guide to the budgetary effects of legislative 
proposals aimed at increasing the use of health IT. For 
example, both studies attempt to measure the fetmtul 
impact of widespread adoption of health IT. not the Mtfy 
impact: l CBO cost estimate, by contrast, would estimate 
the likely effect. And whatever the no savings to the 
health care system as a whole, the impact on the federal 
budget would be far smaller than that. Medicare and the 
federal share of Medscaid together account for only about 
one-fourth of total spending for health ate services. 
Moreover, some types of savings, such as those from 
improved efficiency within a physician's office, could not 
be rrafued by Mediate without reusing payment rates to 
physicians, which usually requires legislation. There art 
also other reasons, discussed in detail below, that the 
studies arc not appropriate for estimating the impact of a 
legislative proposal. The bottom fate is that both studies 


appear to significantly overstate the savings for the health 
care system as a whole— and by extension, for the federal 
budget— that would accrue from legislative proposals to 
bring about widespread adopcioa of health IT. 

TV RAND Analysis. The RAND analysis itself notes that 
its estimate is of health IT's potential savings and costs: 
*Wc use the word pomtul to mean 'assuming that inter- 
connected and interoperable EMR systems ate adopted 
widely and tad tflkurrh [emphasis added].* Thus, out 
estimates of potential cavings ire not predictions of what 
will happen but of what could happen with HIT [health 
information technology] idipfevfnjitrfvKgi m A »kh 
are [emphasis added]* I Hillestad and others, 2005, 
pi 1 104). By incorporating the assumption of 'appropri- 
ate changes in health ate.' the study's estimate deliber- 
ately does not take into account present-day payment 
incentives that would constrain the effective utilization of 
health IT. even if the technology was widely adepted. A 
key reason for the currently low rate of adoption of health 
IT mar be that, given the wav health are financing and 
delivery arc now organiud. the payment methods of both 
private and public health insurers in many cases do not 
reward providers for reducing some typo of costs— and 
may even perdue them for doing so. Mott providers art 
paid oo a fet-for-scrrice basis; if they were to redixe 
health are cats by providing fewer a less expensive ser- 
vices. they would have to submit lower charges to insur- 
ers. and as l roult. their payments would decline. If tech- 
nologies were adopted without changing those incentives, 
then the RAND estimate would be too high because the 
"appropriate changes in health art’ assumed in the study 
would not have been made. 

Another issue raised by the RAND study n that it was 
based solely on cmpirkal studies from the literature that 
found positive effects for the implementation of health 
IT systems. Researchers offered (his rationale ‘We chose 
to interpret reported evidence of negative or no effect of 
HrT as likdv being attributable to ineffective oe oot-vw- 
effective implementation* I Hillestad and others. 2005. 
pL 1 105). However, a number of studies of health IT pub- 
lished in petr-trviewrd journals have foiled to find favor- 
able results (for example. Garrido and others. 2005: 
Ovethage and others, 20011. Consequently, the decision 
to ignore evidence of zero or negative net savings clearly 
biases— possibly quite substantially— any estimate of the 
actual impact of health IT on spending. 
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The methods researchers used in the RAND study would 
not be appropriate for assessing (be usings (Kat a Icpsla- 
tree proposal would generate because, unlike (be proce- 
dures used for a CBO cost estimate, usings were not 
measured relative to a current-law baseline. Instead. 
RAND researchers used the level of health IT adoption in 
2004 as a hasehne and assumed for comparison purposes 
that adoption remained at that lor! during the period 
ora which they projected usings. A CBO cost estimate, 
howeser. would reflect the continuing growth in health 
IT adoption that would occur without any change in bw. 
To the a tent that health IT adoption has grown since 
2004 and will continue to grow, that growth reduces the 
posable cost savings. compared with RAND’s estimate, 
that could come about by encouraging wider adoption. 

In several specific parts of the RAND analysis, the savings 
that would accrue from widespread adoption of health IT 
appear to be overstated. Foe example, it is likely that the 
RAND researchers significantly osetestimated usings for 
health IT horn reductions in the average length of stay in 
a hospital. 9 The RAND researchers assumed that reduc- 
tions in lengths of stay would result in proportional 
reductions in costs. They noted, though, that health FT 
would pnminh' reduce lengths of stay by speeding up 
how quickly procedures were performed. If that is the pri- 
mary channel through which lengths of stay are reduced, 
at least some costs will simply be shifted to earlier days in 
the stay aod not eliminated— which argues foe a reduc- 
tion in costs that is less than proportional to the reduc- 
tion in die average length of stay. 1 ''' 
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The RAND estimate also failed to take into consideration 
that hospitals often achieve reductions in their average- 
Icngih-of-stay measures by shifting patients to another 
health care sire, such as a skilled nursing facility. That 
practice produces fewer net usings because although 
such shifts reduce costs in the hospital sector, they 
increase them in the skilled-nursing sector. 

Another issue raised by the RAND analysis is the method 
that the researchers used to estimate savings from elimi- 
nating or reducing the use of papa medical records: They 
based their findings on the aperienco of recent adopters 
of electronic medical record systems and then applied the 
savings to all physicians' offices. Yet that assumption 
ought not be realistic for small practices (those that have 
fewer than four practitioners) because the same person 
who pulls duns in those office typioBy also schedules 
appointments, administers billing, and performs other 
administrative tasks. Thus, although the overall workload 
of such staff might be diminished, those practices would 
find it difficult to reduce their costs by eliminating sup- 
port staff positions. .About half of physicians are in small 
practice; conscquemly, RAND’s estimate of savings in 
this area is probably overstated. 

Finally, the RAND study did not consida the broader 
impact that reducing at least some types of health care 
costs would have on the utilization of services. If die 
widespread use of health IT reduced the cost of health 
care services, that decline would eventually be reflected in 
lower prices and copayments foe patxms— and as prices 
fell, patients would demand more are. Even if the 
researchers' underlying assumptions about savings are 
accurate, the net effect of more use of health IT would 
probably still be Iowa overall costs than would otherwise 
be the case— but the reduction would not equal the 
amount (hat the HAND analysis has suggested. 

Hie Study by the Center for Information Technology 
leadenhipL Many of the same concerns rused by the 
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RAND analysis apply so the study conducted by CJTL 
For one thing, the authots dtd not (oily consider the 
impact of financial incentives in their analysis: they did 
not take into account the effect of those incentives on the 
use of health IT by providers. hospitals, and insurers or 
the effect on patients' demand fra health care services in 
the event that health H reduced the cost of are. The 
CITl analysis abo estimated die SSO billion in potential 
savings against a baseline of link or no information tech- 
nology use. Savings would come, the study suggests, by 
moving the U.S. health care sector from Level I (with 
coenplcttly ncfldecnonk dan and with all information 
written down or shared verbally I to Level 4 (with all stan- 
dards machine-cmetpteubk data). The impact of 
moving from die current level of adoption to level 4 
would be much smaller because many of the nations 
health care providers already operate above Level 1 in 
their use of technology. I For eumpie. level 2 includes 
the use of fax machines, which are widely available in 
physicians' offices today! As the report by Pan and others 
(2004) states, ‘the model [usd in the study] does not 
account for the ‘current state of affun"’ (p. 17). 

Like the assumptions in the RAND analysis, some of 
those that the Cm study usd appear to be overly 
optimistic 

■ The Cm study cstinurd that the administrative 
cost of a laboratory test (encompassing both the pro- 
vider's and the lab's expenses! was about $40 and that 
widespread interoperability could save about $38 per 
rest— producing estimated national tilings on lab 
tests of about $25 billion annually. However, the 
results of another analysis I Baket 2005) raise doubts 
that the administrative cost of a lab test could possibly 
be as high as $40 to begin with. 

I The Cm researchers assumd that folly interoperable 
health IT systems would eliminate 95 percent of 
avoidable tests, resting that assumption on the belief 
that physicians would choose to override the system's 
warnings on such rests only 5 percent of the time. 
Other estimates of avoidable tests typicily report 
higher override rates, however (Rates and colleagues, 
1999b). 

■ The Cm study abo assumd that ar the highest level 
of health IT adoption, only 0.001 percent of prescrip- 
[ions would require a phone call between j pharmacist 
and a prescribing physician. Certainly greater imple- 


mentation of health IT could significantly reduce the 
number of those telephone calk but the reduction 
that the CITL researchers assumed does not appear to 
be attainable. 

Evidence on Improvements in Efficiency from 
Adoption of Health IT 

The potential of health IT to reduce spending for beakh 
care depends in large pan on its abiloy to make care more 
efficient by cutting the cost of delivering services, avoid- 
ing rdundim services, and improving providers’ produc- 
tivity Evidence from the literature on health IT, however, 
does nor uniformly support the possibility of such sav- 
ings. The potential for savings appears to depend bendy 
on their source and whether that source is in a hospital or 
in an ambulatory care setting (such as a dink or a physi- 
cians office). In addition, savings are difficult to assess 
because the trimming of costs in one area of a physician s 
practice, for example, may be offset by increased costs or 
reduced efficiency in another area. 

Estimating the impact of some potential sources of sav- 
ings, especially those arising from greater exchange of 
information among providers, insurers, and patients, tv 
especially difficult because health IT networks arc in an 
early stage of development. Furthermore, health care 
providers and hotphak that were early adopters of health 
IT may have ban motivated by particular characteristics 
of their organizations or operations that made them more 
likely than nonadopcers to achieve benefits from health 
IT— in wbkh case the outcomes they have seen might 
not be generalizablc. Evidence of savings in the health 
care sector as a whok from adoptit^ health IT is also 
limited. 

Nevertheless, savings could acctue in a number of areas: 
the handling of medical records, the redundancy of diag- 
nostic tests, the prescribing and use of drags, the produc- 
tivity of caregivers, and the length of hospital stave Sav- 
ings could also arise if a comprehensive insttoperabk 
health IT system. including a health information 
exchange that facilitated the sharing of health care infor- 
mation. was implemented. 

Eliminating Paper Medical Records. Providers typically 
adopt EHRs with the intention of replacing their paper 
medical record systems. Research has shown that physi- 
cians' offices can realire savings from reducing the pulling 
of paper chans and die use of transcription services 
iMTang ind others. 2003). Those savings might not apply 
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in my small practice*. however, because such offices r>p- 
kdy hast low bur rrfatnrly hud axes related to medical 
records and the physicians who work there are much 
more likely than those in larger practices to write notes 
manually in the charts. Savings from less pulling of charts 
is typically accomplished by redudr^ the number of sail 
required to do so. Rut that type of staff reduction may be 
impossible in a small practice if the employee who pulls 
chans also performs other tasks (such as scheduling and 
billing), as is usually the case. 

The extent of savings to he gamed from eliminating paper 
medical records would also depend on how wefi a physi- 
cian used the new system. For eiample, most EHRs alkm 
physicians to create templates that can significantly 
reduce the amount of time spent typing in notes, order- 
ing medications, and so forth. But making effective use of 
templates and ocher features of EHRs would require a 
physician to make a substantial up-front investment in 
time to create templates suited to his or her style of prac- 
tice and to team how to use them effectively. 

Moreover, many physicians would hare to alter the wav 
they practiced medicine to make a health IT system work 
for them, and noc all physicians appear willing to make 
such changes. For example, some providers who hast 
already installed EHRs continue to maintain paper 
chans; Miller and colleagues 12005) noted that 10 of 14 
practices they examined stopped pulling charts— which 
implies chat 4 practices still did noc Presumably, as physi- 
cians became more accustomed to the new electronic sys- 
tems, they would stop using paper charu. 

It uiding Duplicated or Inappropriate Diagnostic Tests. 

The possibility of duplicating diagnostic tests arises when 
patients arc seen by different physicians in multiple facili- 
ties or when records make it difficult to discern which 
tests hare or hart not been administered. Inappropriate 
testing can also occur because of a physician's habits or 
preference, and a pattern of such testing may be easier to 
identify and change if information is in an electronic for- 
mat For the most part, any savings from avoiding dupli- 
cate or inappropriate diagnostK tests would he realized 
primarily by a health insurance plan, not a health care 
provider Thus, the atent to which savings in this area 
would actually benefit providers is unclear. 

Despite somewhat mired result! most evidence suggests 
that EHRs hare the potential to reduce the number of 


inappropriate laboratory tests. Rates and colleagues 
I1999b| found that providers canceled 69 percent of lab 
tests when alencd by an electronic notice that a test 
appeared to be redundant. That result, when combined 
with a related estimate that 9 percent of all lab tests 
appeared to be redundant (Rates and coleagues. 1998b), 
implies that EHRs with a notice of redundancy could 
rcdiKe the number of laboratory tests by about 6 percent 
(69 pcrcenr of 9 percent}. Consistent with this estimate, 
research by Tierney and others (1987) found that show- 
ing physicians information about a patient s previous lab 
work when they ordered a test in a clinic's older entry sys- 
tem and reminding them of the date of the patient's last 
test reduced the volume of tests ordered by about 6 per- 
cent- A second study reported br Tierney and colleagues 
in 1988 found a drop of about 9 percent in lab charge! 
The Tierney research, however, is based on dan collected 
in the mid- 1 980! and its applicability in todays health 
care environment is questionable. 

By contrast, an evaluation of laboratory services in the 
outpatient facilities of two separate Kaiser Permanmtc 
regions that adopted health rT systems did not find a dif- 
ference in the number of duplications as a result (Garrido 
and others, 2005). It is unclear whai specific methods the 
systems used to prevent the duplication of tests and 
whether using the same methods shown to be effective in 
other studies weiuld alto have been effective fee the Kaiser 
facilities Moreover, as a filly integrated HMO. Kaiser 
may have already used non-health IT methods to reduce 
the number of unnecessary tests. For that reason, the 
results of the study may not be applicable to the non- 
HMO health care sector. 

Reducing the l sc of Radiological Services. Less informa- 
tion is available about the impact of EH Rs on the use of 
tadiological scow. The Garrido team's 2005 study of 
Kaiser facilities abo crammed imaging and. as was the 
case with laboratory testing, found no change following 
the adoption of health IT. A study by Haipole and others 
(1997) found that providing physicians with evidence- 
based critiques of certain types of imaging at the point at 
which a provider orders a radiological study (that is. pro- 
viding a clinical decision support system) had no signifi- 
cant effect on whether or noc a test was ordered but did 
influence the types of radiological images that were taken. 
Health IT thus appears to case the job of monitoring tbc 
use of radiological service! but there is little evidence that 
it hdps control costs. 
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Promoting the Ccsl-Eflectisc I « of Prescription Drop. 

Eviilencc swgests that in hospitals, features of EHRs— 
specifically, clinical decision support (CDS) and comput- 
erized physician order enny— could hdp reduce the con 
of prescription drugs by prompting providers to ore 
generic altetnatim, lower-con therapies. and. for more 
complex drug regimens, cost-effectht drug nurugcmmi 
programs (Mullen and others. 2001: Tekh and others, 
2000). In ouiparient settings such as clinks and physi- 
cians' offices, health FT— spccificJy, {-prescribing— 
could alter prescribing practices in the direction of lower- 
cost drugs. 1 

Little empirical evidence exists, however, on the effective- 
ncss of hcahh IT to help manage the use of prescription 
drugs in either hospital or outpatient settings. One factor 
limiting cost savings is that physicians gentnly do not 
benefit financially from cffecthrb managing the utiliza- 
tion of drugs. Instead, any financial gain is usually real- 
ized by hcahh plans or pharmacy benefit management 
companies (PfiMs). Moreover, because of their strong 
incentives ro bold down costs, hcahh plans and PBMs 
may already he capturing a substantial portion of rhose 
savings. 

Inprosing (he Prodncihin of Nurses aad Physicians. 

Several analyses have investigated whether EHRs in hos- 
pitals and outpatient facilities might increase the produc- 
thity of nurses and physicians. A 2005 summary of 
research by fassam and others suggests that when health 
FT systems were in use, nurses in hospitals saw drops in 
the time required to document the ddivery of care bur 
physicians saw increases in documentation time. Thar 
finding implies that hospitals might be ahle to reduce 
their spending on nurses but not necessarily on physi- 
cians. Those studio, however, may have identified a 
short-term effect among physicians— that is. before 
prtniders had become accustomed to the new system and 
incorporated the new methods into their daily routine. In 
addition, most studies have aamined health IT in teach- 
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ing hospitals, and the general nihility of their results to 
more typid community hospitals may be limited. 

Few studies hast measured the effect of EHRs on physi- 
cians' efficiency in outpatient settings, and those that 
have show mixed results iPizzifcrri and others, 2005: 
Ostrhagie and others, 2001 ). The lad of demonstrated 
gains in productivity as a result of implementing health 
IT systems may be partially due to some prtniders’ ten- 
dency to duplicate the systems functions by continuing 
to do some tasks manuals, such as maintaining paper 
records (Cans and others. 2005: Overhage and others. 
2001). Physicians that eirniinatc or reduce their use of 
transcription senkes by adopting a health IT system may 
tee usings, though. Intermounuin Healthcare maintains 
that its usings from reducing transcription cose alone (as 
high as $12,500 pa year for some physicians) contrib- 
uted substantially to paying for its EHR. which cost 
about $2,500 per physician. 1 * 

The measures of producthity that research ns hast used 
in such studies are relatively narrow and do not exhaust 
the ways in which the use of health IT might affect health 
arr workers' productivity. For example, the improve- 
ments in documentation that EHRs provide might help 
physicians improve their caregriing: If such systems led 
providers to spend more time documenting the care they 
delivered, the end resuh might be higher-quality care. 
Health IT systems might also enable a physician to pro- 
vide other scnices for patients, such as helping than get 
appropriate preventive care, providing better education 
about their health, and assisting them m nuking choices 
from among an atray of treatment options. 


Reducing (he Length of Hospital Stays. Some research 
IMckhjun and othns, 20021 suggests that health IT 
could reduce the average length of a hospital stay by 
5 percent or more by speeding up certain hospital func- 
tiom (such as ordering and completing tests, ordering 
and administering medkatkms, and collecting informa- 
tion and preparing for patients' discharge I and \n avoid- 
ing costly errors (such as adverse drug rrxtiom that 


could lead to delays in discharging patients). Other 


research has produced muni results. 
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As discussed earlier wiih retard to the RANI) study, 
reductions in the iraax length of hospital stays are 
unlikely to result in cost saving? of a similar proportion to 
the reduction in avenge length of stay, such as that found 
by the Mekhfun research team I that is, of 5 percent or 
motel. In particular, reductions in stays that stem front 
performing carious hospital functions more quickly are 
not likely to cut cows as much as will reductions that 
result from improving care— for cumple. hy diminishing 
the number of advene drug reactions. Reducing the 
length of time required to process a lab test or diagnostic 
image from the time it is ordered to the moment the 
results are deferred only speeds up the delivery of arc; it 
does not necessarily reduce the amount of care provided 
or its associated cow. 

Moreover, the promise of shortening the average length 
of lime that a patient stays in the hospital might trot be 
sen compelling to a typical institution because it already 
faces a sizable financial incentive to pare its ants per 
admission. Payment incentives in the Mediate program 
that encourage hospitals to reduce their per admtssioa 
costs base been in place since the early 1980s; the average 
length of stay has fallen steadily since then, although 
recently, the downward trend has slewed (National Cen- 
ter for lleahh Sratiwia. 2007). In all likelihood, the 
majority of hospitals hart already made mow of the 
changes necessary to maximire their payments for the 
care of Medicare patients, and the additional money they 
would get Iran the not increment in reducing the aver- 
age length of sot might not be worth the additional 
investment in health IT needed to produce it Moreover, 
the payment methods for hospital stays that are common 
among private health plans— pet diem payments (that is, 
a set fee per day in the hospital)— may work against 
shortening those stays. 

Evidence on Improvements in the Quality of Care 
from Adoption of Health n 

The use of health IT applications has the potential to 
increase patients’ safety within the overall health care sys- 
tem and improve the quality of the arc that physicians 
and other caregivers provide. When used for prescribing 
mediations. EHRs and their computerized physician 
order entry features can help pres ent costly medial errors 
by checking patients' medial records and the bu of med- 
iations they are taking, screening the list for possible 
drug allergies and drug interactions, and aiming physi- 
cians to any potential conflicts. The quality of health care 
could be improved through the use of dinical decision 


support systems to remind physicians to schedule tests, 
help diagnose complicated conditions, and more effec- 
tively implement appropriate protocols for treatment. In 
addition, the extensive dan about patients tharthe use of 
EHRs generates might allow researchers to inform evi- 
dence-based guidelines and compare the effectiveness of 
different treatments for different patients as well as the 
effectiveness of different designs foe the delivery of care. 1 3 

like die benefits Iran delivering care more efficiently, 
however, benefits that stem from improving the quality of 
care— and the potential cost savings that accompany 
them— are primarily realized by patients and insutm 
rather than the providers who generally make the invest- 
ment in health IT that leads to those benefits. Seldom are 
providers directly compensated for improvements in the 
quality of their care. Indeed, if those improvements, for 
example, cm down the number of hospitaliratioets and 
office visits, they might actually reduce a provider's com- 
pensation. especially in the case of providers paid on a 
fte-foe-service basis (as is commonly the case). Improve- 
ments of that kind might enhance a providers reputation 
and thereby attract more patients over the long run. But 
those outcomes would not necessarily increase a pro- 
sider’s income ot lower his or her cows. (Also, some 
providers might discount the value of those benefits 
because they already had what they considered to be a 
sufficient number of patients and felt no need to add new 
ones.) 

A possible benefit of improving are through the use of 
health H however, might be to lower malpractice insur- 
ance costs for providers. A number of films that sell fia- 
bilkv insurance for physicians arc beginning to offer dis- 
counted premiums to practices that use EHRs. 13 

Voiding Adverse Drug Events. One of the mow common 
types of medial error— and a focus of much research— is 
a so-called adverse drag event, in which a patient has an 
adverse traction from being administered an inappropri- 
ate mediation. Research examining serious errors in the 
mediations that patients receive in hospitals has shown 
that such mistakes are both common and potentially 
expensive and that they oould be substantially reduced 
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through grater use of beakh IT. Studio hair (bund 
potential reductions m error rates from the uie of health 
IT of between SO percent and over 90 percent (ftxts and 
others. 2004: Kates and others, 1999a. l99Sa: Evans and 
others. 1998). 1 ' In a few other studio iHan and others. 
2005: Nebcker and others. 2005: 1'ppentun and others. 
2005). ttsearchers did not find that the rate of advene 
drug evetsts was kmcred— although that result might 
hare had more to do with the quality of the health IT sys- 
tems bang used than the performance of such systems in 
general. 

Much less evidence is available on boa EHRs affect 
adverse drug events in outpatient settings. One study 
(Gandhi and others, 2005) found no oidence of reduc- 
tions in such errors but qualified those findings by point- 
ing out the belt of sophistication of the systems used by 
the physicians in the study. 

By maintaining a list of a patients allergies and current 
medications, a health IT system nukes it easier for doc- 
tors to check for drag and drug- allergy interactions and 
for contraindications (stemming, for example, from the 
results of a laboratory test) to prescribing a particular 
medication. Health IT systems an also speed providers' 
access to lists of possible side effects of particular drugs, 
which allows physicians to quickly verify' whether a drug 
is appropriate for a given patient. Most EHRs (with or 
without a CPOE feature) automatically check for allergr 
ud drug intcrKiions and for (he appropriateness of a 
particular mediation and warn the physician of potential 
conflicts. Such systems an abo provide doctors with 
standardized dosing amounts or recommended dosing 
guidelines dial an help prevent errors in cnrnncdictring 
and undermediating patients. Further, the automated 
prescribing practices possible with CPOE features may 
help reduce errors resulting from mkommunscation 
among physicians, pharmacists, patients, and nurses. 

Because medical errors can lead to (he use of additional 
health cart services, health IT systems that successfully 
reduce such errors may also diminish expenditures oo 
health care. The effectiveness of health IT in reducing 
errors, however, depends largely on the type, setting, and 
quality of the systems. One study (jha and others. 2001 ) 
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found that 1 .4 percent of hospital admissions were caused 
by adverse drug events, and 28 percent of those were con- 
sidered preventable. The averse cost of treating the coo- 
sequences of a preventable adverse drug event, researchers 
estimated, was more dun $10,000. Another study 
(Honigman and others, 2001 ) determined that advene 
drug reactions that arose through care provided at an out- 
patient facility- and that required hospitalization occurred 
at an average annual nit of 3.4 for every 1 .000 patients. 
Avoiding even a fractioa of the errors that now occih in 
inpatient and outpatient settings could yield significant 
savings. 

Some of the potential savings from errors originating 
among outpatient providers, however, are probably 
already being realized by existing electronic systems. Even 
though today very few prescriptions Ian estimated 7 per- 
cent in 2008) are handled cxduvhrfv through electronic 
means, some aspects of prescribing art almost universally 
electronic For example, neatly all pharmacies connect 
electronically to health plans when they enter a patient's 
prescription into their computer system. At that point, 
the health plan has data on most if not all prescriptions 
that the patient has— and the pharmacist has that infor- 
mation through the health plans system— and both the 
health plan's and the pharmacy's systems typically check 
for drug interactions and possible afletgK reactions. (If a 
PBM is also invoked, it may undertake some checking as 
wdl I A provider's health IT system might still contribute 
to improving the quality of a particular patterns care if. 
for example, the patient had a result from a recent lab test 
that might suggest something about his or her response to 
a particular mediation— although it is becoming more 
common for beakh plans also to have access to lab resuks 
iSureSoqrts, 2007). 

Expanding Exchanges of Health Carr Information. The 

adoption of interoperable heakh IT systems could case 
exchango of health arc information, which might not 
only imprest the quality of care hut abo reduce costs. 
The effects of expanding sixh exchanges indude: 

I Lessening the duplication of diagnostic procedures 
(because results could more easily be made available to 
other providers); 

■ Preventing medical errors (because peoviden would 
have more accurate and more complete information 
about the patients they arc treaiitg); and 
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■ Lowering administrative costs (because automated 
transfers of test results, dinical information, 2nd pre- 
scriptions among health imurerv phrskuns' offices, 
hospitals. laboratories. imaging facilities, pharmacies, 
and public health agencies would be less costly than 
manual transient. 

The rtalcation of other benefits from greater exchange of 
information, such as the availability of more datfa for 
medical research, lies further in the future (see the later 
discussion). 

An increased capability to exchange information s not 
sufficient, however, to reduce costs and improve the qual- 
ity of health care because existing mechanisms for paving 
providen do not create incentive to reduce costs by act- 
ing 00 that information. Indeed, in some cases, those 
mechanisms create incentive that discourage efforts to 
cut costs. For example, a provide who is paid on a fee- 
for-senice basis might refrain from ordering a diagnostic 
test if the results of the same test recently ordered by 
another provide were in the patients EHR (owing to 
health information exchange): home, that foe-for- 
senice physician would have no financial inceuhr to do 
so. Moreover, if the physician could perform the diagnos- 
tic test m h» or he office by using otTice-based equqs- 
ment (such as an X-ray machine), the stronge financial 
incentive would be to ignore the previous test’s results. 

One potential source of empirical evidence on the bene- 
fits of health information exchange is die experience of 
integrated health systems that use systemwide EHR*— 
although separating out the impact of expanded informa- 
tion exchange from other health IT-tdated effects is diffi- 
cult. The case of the VA illustrates some of the empirical 
challcr^es. The agency reports that in cost per patient 
has stayed relatively flat over the past several tears, which 
it attributes in part to reducing the number of foil-time- 
equivalent employees per 1.000 patients by 37 percent at 
the same time that the cost of medical care has been rising 
by about 6 percent pet tear (Evans, Nichol and Berlin. 
20061. After an adjustment for changes over rime in the 
mix of patients that the VA sets, in spending per entollce 
grew by a total of 1.7 percent in teal terms from 1999 to 
2005 (0.3 percent annually}— a rate significantly below- 
Mediates teal rate of growth in costs per capita of 
29.4 pettem (4.4 percent pet year) over the same period 
(Congressional Budget Office. 2007a). 


Those results cannot be attributed solely to the impact of 
the VAs health IT program, however, because the VA dif- 
fers in many wars from Medicare and other pans of the 
health system. In addition, the VA adopted other efforts 
to control costs during the 1999-2005 period; for exam- 
ple, it switched from a labor-intensive inpatient system to 
a system of outpatient cfinics. 

Expanding the Practice of Evidence-Based Medicine. Pan 

of the motivation for the broader adoption of health IT 
has come from evidence of deficits in the quality of heal th 
care in the United Sates and large unciplaitxd geo- 
graphic variations in the utiliaation and cost of cart 
iMcGlynn and others, 2003: Congressional Budget 
Office. 2008). 16 Many heakh IT systems have some type 
of dinid derision support function— such as automated 
rcmindcfs about preventive ate— that could help physi- 
cians adhere to evidence-based guidelines, avoid prevent- 
able errors, reduce the use of procedures that have no 
demonstrated clinical value, ultimately improve the qual- 
ity of the Carr that they provide, and possibly cut costs. 
Measuring the efTccts of using clinical decisioa support 
on the costs and outcomes of ate for patients is difficult, 
though. At this stage, empirical research has shown that 
the use of health IT in general and CD5 features in par- 
ticular can improrr the quality of patients cate, but it hat 
nor shown that improving care can, in turn, improve 
patients' health or reduce costs. 

Several studies suggest that CDS fnlures can improve the 
quality of health arc 

■ (lug and colleagues (2005) reviewed studies on dini- 
al decision support and found that most such func- 
tions improved the performance of practitioners. 
Reminders about using established gtuddmet for pre- 
ventive cate were found to be the most effective fea- 
ture. However, few of the studies that Garg reviewed 
also reported improved outcomes for patients. 

■ A sdi and others (2001) found that the quality of cart 
received by patients in the V'A system, which uses an 
EHR chat includes CDS tools, wav superior to that 
received by a nationally representative sample of the 
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■ population. 1 The V'A practitioners' adherence to 
recommended -are guideline was grates for indica- 
tors of qualm' care that were associated with a YA per- 
formance measurement program (in which the care 
that practitioners peovide n tracked and monitored 
and feedback is given to each practitioner about hit oe 
ha performance). Howrva, a CBO's 2008 report on 
geographic sanation in health care spending notes, the 
YA medical system varies substantially across the 
natioo in patterns of dinkal praaicc, despise the fact 
that managers track providers compliance with 
national guidelines for the treatment of many medical 
conditions. 

■ Consistent with the results from the YA. recently 
released data from a Median: demonstration project 
of the Centers for Medicare and Medicaid Services 
(CMS) suggest that practitioners respond to rewards 
fix high-quality care (Lindctuuer and offsets. 2007). 
In that study, researchers coupled a CDS system with 
incentives to achieve a higher level of quality. 

Yet a CDS capability docs not abnys improve the quality 
of patients' cart, and ev en if h could, that improvement 
msjw not have die desired effect on costs. According to a 
broad range of research (Crown and others, 2007; 
Linda and othets. 2007; Seqow and others. 2005; Tia- 
ncy and whets, 2005, 2005; Murray and others, 2001: 
Subramanun and others, 2004; Harris and when, 1 998). 
CDS functions have foiled to increase physicians' adha- 
eocc to evidence-bused standards of treatment for a wide 
variety of conditions, including chronic obstructive pul- 
monary disease, heart disease, diabetes, coronary artery 
disease, chronic heart foihire. chronic renal insufficiency, 
and hypotension. 

The failure to find positive effects from the use of CDS 
tools for those conditions could be due more to mis- 
aligned financial incentives than to limitations in the 
technology itself, or it could be attributable to the poor 
quality of some CDS features. Like all aspects of health 
IT, such tools are nw uniform, nor are they all used 
equally welL The systems hate been variously cffticired as 
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'cookbook* medicine as not fitting well with the particu- 
lar patterns of work in a gnoi practice, or as unable to 
positively affect providers' behavior (Ftisse, 2006; Sittig 
and others, 2006; Bata and others, 20031- With time, 
the quality of such systems may improve, and users may 
be barer able to routinely achieve the positive effects 
noted in some studies. 

BettaCDS tools could abo boost spending in some 
ways. For example, the use of some features (such as 
reminders to practitioners about screening tests and other 
preventive services) could increase spending for health 
are by encouraging the utilaatioo of some additional 
services. Moreover, physicians might order some recom- 
mended preventive treatments that were not cctsr- 
eftettive — bcasise even though «ach practices might 
improve the health of patients, then costs might nw be 
completely offset by reductions in future health care 
spending. 

teneriti*g Data for Research on Comparaiiie 
Effectiveness and Cost-Eflrctiveness of Treatments. Pro- 
ponents of the adoption of health IT note its potential to 
proiAr a massive source of new health care data— oner 
patients' identifying information has been removed and 
the data have been standatdired and assembled in a 
repository— for research on the comparator effectiveness 
and cost-effectiveness of medical treatments. The data 
could provide more-comprehensive information about 
the health histories of different patients and about the 
outcomes of their treatments than has previously been 
available. And the depth and breadth of chc data would 
nude it easia to take into account the differences among 
patients who rector different treatments and allow 
researchers to assess a broad so of outcomes. 

Some w ork of that nature n being conducted through the 
H.MO Research Netw ork and through a broader network 
of centers having access to electronic databases that was 
established in 2005 by the Agency' for Healthcare 
Research and Quality (Congressional Budget Office, 
2007b). The knowledge gained from such studio could; 

■ Improve treatment protocols and mahods. 

■ Lead to betta outcome for patients. 


■ l-ower costs for health arc, 
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■ Improve pcwmarketing surveillance of pharmaceuti- 
cals (to ensure tfut a drug is effective tod has no unex- 
pectedly haimfol sade effects) that hire ban approved 
by the Food and Drug Administration, 

■ Help target public health efforts, and 

■ Support early detection of outbreaks of diseases. 

Tire Costs of Implementing Health 
Information Technology 

Implementing a health IT system, whether in a single 
physician s practice ot m the multiple venues of an inte- 
grated health care delivery system, involves significant 
expenditures. Total costs for a health IT system include: 

■ The initial filed cost of the hardware, software, and 
technical tssisrance necessity to install the system; 

■ Licensing fees; 

■ TTse eipense of maintaining the system; and 

■ The ‘opponunity cost’ of the time that health care 
proiidcTs coaid have spent seeing patients but instead 
must devote to learning how to use the new system 
and hew to adjust their work practices accordingly. 

The costs of implementing health IT systems vary widely 
among physicians and among hospitals, depending on 
the site and complexity of those plunders' operations and 
the extent to which a system's users wish to perform char 
work ckaromcaflr. 

Owing in pan to the wide variation in costs, evidence on 
expenditures tor implementing health IT systems rends 
to be limited and somewhat conflicting. The initial 
inststmem and the cost of maintenance can be billy eas- 
ily determined— proriders can obtain bids for a system 
from one or more vendors and thus have l rdamth accu- 
rate esnmate of what those costs will be oacc they have 
selected a vendor: Much less predictable n the productive 
time lost in learning to use the system and in adjusting 
patterns of wwk. Yet that nonmonetary investment may 
be an impotunr factor in whether providers wiB be able 
to use the system dlcctively. 

Social costs may also be a factor in providers' adoption 
and use of health IT. and one such potential cost is the 


risk of lost privacy. Purchasers of health IT systems, 
which must comply with stringent federal and state tub 
and standards intended to protect patients' privacy, hear 
the monetary costs associated with such protection. 

Oven the case with which information an he exchanged 
between health IT systems, patients whose physicians use 
them may fed that their privacy tt more at risk than if 
paper records were used. (Health IT might also, though, 
support efforts to strengthen privacy by making it easier 
to track who accesses i pattern's medical record.) 

The Cofl of Health IT Systems for Physicians' Offices 

Estimating the tod cost of implementing health IT in- 
terns in office-based medical practices is complicated by 
differences in the types and available features of the sys- 
tems now being sold and differences in the characteristics 
of the practices that are adopting them. Many existing 
studies of the costs of implementing such systems lump 
together all dhcct costs (for hardware, software, (kerning 
foes, installation, and training), do not include estimates 
of indirect costs (foe example, practitioners' reduced pro- 
ductivity during the early stages of adoption), and spread 
the costs of implementation over different time frames. 

The few detailed studio available repoet that total costs 
for office-based EHRs are about $25,000 to $45,000 pa 
physkian (Gam and others, 2005; Kibbc and Waldren, 
2005). 18 Estimates of annual coin for operating and 
misnaming die system, which include software licensing 
foes, technical support, and updating and replacing used 
equipment, range between about 12 percent and 20 per- 
cent of initial costs, or $3,000 to $9,000 per physician 
per year i Miller aid others. 2005: Wing and others, 

200*3). 

Those studies indicate that unifier groups of physicians 
typically pay more per physician dun do larga offices to 
implement health IT systems (Gam and others, 2005). 
Otha possible savings may not depend oa the site of a 
practice. Nearly all physicians already use information 
technology to manage the business side of their praetkes. 
Thus, many offices may already have much of the hard- 
ware ntcessary to operate a health IT system and need 
only purchase the software. 
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Moreover. chc prices of health IT products ippeu to be 
filling, i.Kibbe and Waldren. 2005). In particular. some 
Internet-based applications that are becoming available 
maght substantially limit costs to an annual subscription 
fix that could he as low as $2,000 per physician. 19 (How- 
ever. extremely lent prices might signal lower quality and 
fewrr components or features.) If prices continue to fal 
over time, the quantity and quality of the health IT syv 
rems that are purchased should increase. 

Physicians who implement health IT systems typically 
experience an initial loss in productivity as they lam how 
to use the system and adjutuhe ways in which thcT prac- 
tice. In a survey of health IT adoption conducted by 
Gins and others (20051. many physicians' practices 
reported that after they implemented a system, produc- 
thity in their offices dropped by between 10 percent and 
1 5 percent for at least several months. A study by Miller 
and colleagues (2005) found that among a sample of 
1 4 small physicians' offices implementing a health IT syv 
tern, the average drop in revenue from that loss of pro- 
ductivity was about $7,500 per physician. That amount 
may understate the actual loss in peoducthity, however, 
because in some practices, physicians worked longer 
boon to keep the practice's income the same as it was 
before the adoption. 

Hie Cost of LHR and CPOE Systems fur Hospitals 

A few studies base examined the cost of implementing 
EHR and computerized physician order entry systems in 
hospitals.^ Such calculations arc difficult: Hospitals vary 
widely in size and type a variety of different health IT 
applications may be implemented, and there n a gened 
lad of data on cats. Those challenges limit the genetali/- 
ability to other institutions of any single hospital s experi- 
ence in implementing a health IT system. 

For example, two studio-one in 2003 by Fust Consult- 
ing Group and the other reported in 2006 by Kaushal 
and colleagues— were carried out in teaching hospitals, 
making their results potentially unrepresentative of what 
would happen in a typical community hospid. Hist 
Consulting Group researchers used cate studies of five 
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hospitals or multihospid groups to develop a model for 
estimating hospitals' costs for adopting a CPOE system. 
.According to that model, a large 500-bed hospital would 
incur initial costs of S 7.9 million and annual operating 
costs of about $1 35 million; a smaller 250-bed hospid 
would incur initial costs of about $3 million and annual 
operating costs of approximately' $700,000. On average, 
implementation costs fix the health IT system amounted 
to about $14,500 per bed. and annual operating costs 
were about 19 percent of those one-time costs, or $2,700 
per bed. 

The study by the Kaushal research group considered the 
cost of implementing a CPOE system at Brigham and 
Women's Hospid, a 720-bed acadcmk hospkal in Bos- 
ton affiliated with Harvard Medial School. That study 
reported costs roding about $16,000 per star per bed for 
both implementation and maintenance between 1993 
and 2001 

Researchers from the RAND Corporation (Girosi, Meili. 
and ScoviBe, 2005) estimated the costs of implementing 
CPOE systems using data from 27 teaching and nonaa- 
Jernx hospital*. That study reported a considerably 
higher average cost— nearly $63,000 per bod. The 
RAND researchers estimated that annual costs fix main- 
taining and updating the system would qua! 30 percent 
of acquisition costs-a figute that is higher than the cor- 
responding proportion in other estimates and dut adds 
$18,900 per bed per year. Although the RAND study 
used observations from a larger group of hospitals than 
the investigations discussed earlier, its sample ms still 
quite small and its estimates, as well as those of other 
researchers with small samples, should be viewed with 
caution. 

Other fxtorv may contribute to the variation in esti- 
mated costs foe implementing hospitals' health IT syv 
terns. They include differences in the amounts and typo 
of associated coining and Labor costs (for operating the 
system) that researchers may take into account and differ- 
ences in the years from which the dan are taken (because 
of changes from year to year in the trthnoiigies. in costs, 
and in other factors). The RAND analysts observed a rel- 
atively linear relationship between the number of beds in 
a hospital and the hospitali costs fix implementing a 
health IT system and posited that health ft costs sere 
budget driven; that is, such costs arc influenced by the 
amount of money that the hospitjl has allocated for 
spending on health IT in general, and various projects. 
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including an EHR o* CFOE system, arc funded as they 
me to the cop of the hettpiraU’ Eh of priorities. Budgets 
for infbenurion technology for hospitals typically range 
from 1 percent to 3 percent of overall operating expenses. 
Hospitals that arc part of integrated delivery systems with 
sen 4 sophisticated (finical IT capabilities (including those 
in outpatient settings! mar hast budgets for information 
technology that equal or arced 4 percent." 1 

Possible Factors to Explain the Low 
Rates of Adoption of Health IT 

In spite of the seeming advantages that health IT offers to 
physicians and hospitals, the proportion of those 
providers that actually use such systems is relatively sinafl. 
Several factors may apiain the low rate of adoption, 
including the challenges that ante in implementing the 
systems, the inability of prerndet* to caprutt all of the 
financial returns of the health IT systems that they 4 pur- 
chase, the possibility in the case of health insurance plans 
that the efficiencies they gamer through the use of health 
IT will benefit their competitors, and uncertainty about 
the value of the advantages to be gained from adopting a 
health IT system and the evolution of laws affecting its 
acquisition and financing. 

Challenges in Implementing Health IT Systems 

Adopting a health IT system involves more than just 
deciding to spend money, it is a major organizational 
commitment that, for hospitals in particular, will proba- 
bly last for several scars. To tale full advantage of such a 
system may require physicians to substantially redesign 
the way they practice medicine. EHRs arr only as helpful 
as the information that goes into them. Some of that 
information is part of the system when it is purchased, 
but much of the technology’s value comes when physi- 
cians devote considerable time to training, to pctsonala- 
ing the system, and to adapting their work processes to 
achieve the maximum benefits. Not surprisingly, the 
adoption rates for health IT systems arc higher among 
younger physicians, who in general ate mote familiar 
with computers than their older colleagues (who were 
trained with paper duns as an integral pan of patients’ 
care and who may be mote comfortable using such tools 
in their practices; Grossman and Retd, 2006}. 
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In implementing a health IT system, providers must 
choose from among a wide array of vendors and options. 
With so many choices (for example, mote than 40 differ- 
ent EMR vendors) and rapidly developing technologies, 
many providers may be concerned about buying the 
wrong kind of system foe then practice, acquiring tech- 
nology that has already become outdated, or purchasing a 
poor-quality system. They may wish to postpone the 
decision until more of their colleagues have purchased 
systems, allowing them to benefit from others' aperi- 
cnce. Research suggests that providers who have pur- 
chased an EHR system tend to be in practices in which at 
least one physician b ttchnicJy 4 savvy and able to cham- 
pion the cause of health IT (Miller and Sim. 20041. But 
rebindy few practice* include such a physician, which 
mar lead many providers to wait until the systems 
become more standardized and demand coalesces around 
fewer but better-known choices. The luge number of 
vendors and products may slow down adoption in the 
short run. but the winnowing process that occurs as some 
vendors leave the market is likely to identify 4 the products 
that deliver the greatest value per dollar spent. 

.As noted earlier, the prices of health IT systems are fill- 
ing, and over time that dedinc should lead to an increase 
in purchases. One question is w hether such increased 
demand would be constrained by supply problems for 
qualified technicians to instill and maintain the systems. 
Indeed, hospitals and large provider groups have already 
begun to complain about tbe difficulty of finding quali- 
fied technicians to maintain their systems. 

Providers' Inability to Capture Financial 
Returns from Health IT 

Many, if not matt, providers would like to mike more 
use of health IT in their practices, recognizing the tech- 
nology’s potential to improve the quality of the care they 
provide, increase comenicncc foe their patients, and per- 
haps redua cosb in then office. Rut many of those bene- 
fits accrue to others rather than to tire providers who pur- 
chase tbe health IT system. As a result, many providers 
cannot generate the additional income necessary to jus- 
tify the significant investment in time and money that 
the adoption of such a system would require. 

Some benefits to be derived from health IT increase in 
value at the network of those using the technology 
apands— that is, as other providers also purchase health 
IT systems. Providers who an perform fonaioa elec- 
tronically (such as communicating with each odser. send- 
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ing and receiving medial records, prescribing medica- 
tions dectronkalir. and ordering laboratory ind imaging 
procedures! gam when other providers develop similar 
dectmak capabilities. For aamfle, the cost to a primary 
arc physician of sending medal data to a consulting 
specialist '» tar lower with a health IT system— as long as 
the consulting specialist has an interoperable system that 
an receive the dau deoronically. However, some so- 
called network benefits accrue nuinlr to patients or 
health insurance plans and only indirectly to premiers, 
humpies include less duplication of diagnostic tests or 
increased availability of patient dau in accessible reposi- 
tories. which could lead to more research on the best 
practices for treatment and arc. 

Health IT can contribute to improvements in the quality 
of health are dm providers deliver, but it is relatively 
rare for providers to be compensated for such improve- 
menu, Pay-for-pctformancc programs art in effect in 
some managed are plans in the Medkaad program and as 
pilot programs in the fee-for-sewice sector of Medicare. 

Such programs do not create a strong incentive to invest 
in health IT systems, though, because the payments are 
fairfr modest. Another approach that Medicare has 
adopted is to nor pay for poor performance in some areas. 
CMS tecendv began a program under which it wdl noe 
pur for certain occurrences that it alls ‘non emus* or 
‘serious preventable events’ (Department of Health and 
Human Services. 2008). Never events include such inci- 
dents as leaving an object in a patient's body during a sur- 
gery; operating oo the wrong patient or on the wrong 
body pan of the right patient, or preforming the wrong 
surgery*. precipitating an air embotvn as a result of sur- 
gery (in general, an air embolism is a bubble of air ina 
blood vessel that may cause trouble if h moves to the 
bean or bran); and providing incompatible blood or 
blood products. Never events occur rarely, and not paring 
foe a service that leads to such an event is unlikely to have 
a big effect on providers' bdusior in adopting health IT. 

Other than through such programs, the financial rewards 
fot physicians and hospitals from improving the quality 
of their cue (or avoiding the prtnisioa of poor-quality 
services) are indirect A physicians reputation for provid- 
ing high-quality are might improve as a result of invest- 
ing in health IT, and patients might want to set a physi- 
cian who uses an EHR beauxrherbdieve they w4 get 
better-quality care. Health plans, in recruiting demon foe 
their networks of physicians, might eventually find that 
doctors who used health IT systems were more attractive 


to patients than physicians who did not— provided that 
the plans could determine whether those demon actually 
helped them attract and retain nuolkes or lowreed the 
cost of treating them. 

Most networks of physicians today, however, covet nearly 
all the demon in a given area, so physicians who were 
considering an investment in health 11' would probably 
not include in their akubtionv whether their use of the 
technology would nuke their services more attractive to 
health insurers. They would also probably not expect to 
increase their income by improving the quality of the are 
they provided; thus, that factor would probably not be a 
key consideration for them. However, they might change 
their thinking if they knew that they would be directly 
compensated for implementing a health IT system ot if 
they could repon data on the quality of are that they 
provided— daa for which they were being compen- 
sated— only by using such a system. 

Other benefits, such as lower costs for maintaining medi- 
cal records and transcribing clinical data, dearly accrue to 
the provider who purchases the health IT system. For 
eumple, Intermountain Healthcare reports that its nv- 
inp from reducing transcription costs alone (as high as 
$1 2, WO per yen for some physicians) contributed sub- 
stantially to paying foe its EHR. which cost about $2,500 
per physician." But many providers, especially primary 
are physicians in small practices, might gain relatively 
little from implementing such a system beaux their 
practice would be too small to benefit from the efficien- 
cies it would create. (For rumple, many providers would 
not save on transcription costs by purchasing a health IT 
system beaux they were noc using transcription to begin 
with.) 

Competition Among Health Insurance Plans 

Health insurance companies may hair an incentive to 
hdp providers acquire health IT systems: The technology 
could hdp lower the companies' costs by improving both 
the quality of the care chat providers deliver and patients' 
health. But competition may Limit the amount of assis- 
tance insurers gist to providers to implement health IT 
systems beaux the same savings and improvements in 
quality that such a payer might reap if providcis used a 
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halth n system could also benefit competing health 
insurance plans. 

For rumple, suppose Plan A paid an additional amount 
per unit of service to providers who used EHRs in their 
offices. That additional payment would probably be 
determined by the benefit per patient that the plan 
expected to receive from the physician s use of the system 
la benefit that the physician could not capture!. But Plan 
A could nor feline ill of that benefit, cither because some 
of h would go to other posers— for example. Plan B. a 
competitor of Plan A. whose participants were seen by 
the same physician. If Plan B contracted with the same 
physicians that Plan A used but made no additional pay- 
ment fbethe adoption of health IT, it would obtain the 
same benefit that Plan A obtained from improved quality 
and lower costs but would not have to pay fix it. Thus, 
even though payers might gain mans' of the benefits that 
providers arc unable to garner, a payer s inability to pre- 
vent competitors from also pining those benefits mar 
limit the assistance H is willing to gjre providers to obtain 
the technology. 

Health insurance plans might also hesitate to help pay for 
the adoption of health IT systems by providers because 
they cannot fully capture the mums from improving the 
quality of health care services that such systems may 
bring, Health plans undergo open enrollment each year, 
and many cnrollees switch from one plan to another dur- 
ing that time. Unless the improved quality of care yielded 
savings quickly, it would probably do lade to motivate 
insurers to help providers adopt health IT. In bet. health 
care plans largely address the quality of health care ser- 
vices only to the extent that die employers who purchisc 
coverage for their employees demand it. Many employers 
are beginning to ask plans to take steps to improve the 
quality of health ait. However, even ray Large employ- 
ers may have little leverage with insurance companies to 
encourage improvements because their workers are usu- 
ally dispersed across the country. And few employers have 
enough employees in any one community to enable them 
to demand changes. In addition, the outcomes for peo- 
ples beahh that improvements in the quality of arc 
might provide are still unknown in many cases because 
nor enough research has been done. 

Rather than help providers obtain EHRs for dactr offices, 
some insurers use other types of electronic records, such 
as personal health records (PHRs) and payer-based health 


records (PBHRs). The PHR is controlled by the patient, 
the PBHR by the halth insurance plan (see the appendix 
for addtiiorul information). Both types of electronic 
record deliver ar least some of the network benefits to 
payers that would be available if physicians used health 
IT systems. and they present fewer issues related to com- 
petition. For example, even though the information in 
PBRs and PBHRs is not at the same level of detail as the 
tiara in EHRs. such records could still help eliminate 
duplicate diagnosis, tests and identify cuncm media- 
tions and medical conditions through the data on insur- 
ance claims that they do include— information that 
would he helpfiil. for example, in a hospital emergency 
room. But even these alternatives to EHRs have encoun- 
tered obstacles to implementation related to competition. 
Pitot in some markets have been rducrant to share 
claims data and other information, faring that competi- 
tors could use it to their detriment. 

Worries chat the use of health FI' will benefit competitors 
are not limited to health plans. Hospitals and other 
providers may be concerned that such systems will ause 
them ro lose some degree of control over what they may 
consider to be proprietary information: the information 
in their patients' charts. Patients always have the right to 
access their medial records, but if the records are papa, 
the impediments to doing so (including the nerd to make 
copies) naturally limit the number and nature of the 
inquiries they are likely ro make. Medical data that are 
stored electronially. however. coupled with the growing 
availability and popularity of personal health records, 
imply less control of health data by providers and more 
control by patients— and potentially grata access to 
those records by other providers and health plans. 

The increased availability of that information through the 
use of EHRs improves the quality of are for patients. 

( For example, a hospital emergency room with access to a 
patient’s primary ate physician's medial record an ba- 
ler (rat that patient, and researchers have more data for 
evaluating Ac effectiveness of various medial treat- 
ments.) But some providers could lose patients to com- 
petitors the fact that electronic medial records an be so 
easily translated makes it easier for patients to change 
physicians. Providers might also worry that the ease of 
documentation and emphasis on grater transparency 
could have a negative impact if it showed them to be less 
competent than other competing providers. 
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Box 2. 

The Federal Government's Activities as a Payer 


The federal government can influence the develop- 
ment and growth of health information technology 
(health IT) through its operation and management of 
federal programs that finance health care— in partic- 
ular, Medicare, which accounts for about 20 percent 
of all third-party (insurance) payments in the United 
States, and Medicaid, a joint program with the states 
for which the federal government’s share of spending 
accounts for 8 percent o( third-party payments. In 
addition to those two programs, the federal govern- 
ment pays for or provides health care through the 
Military Health System, the Veterans Health Admin- 
istration, the Indian Health Service, and the Federal 
Employees Health Benefits Program. 

What exactly the government should require of 
health care providers in those programs is beyond the 
scope of this analysis. It is reasonable, however, to 
expect that the government would ask the same ques- 
tions asked by private health insurance plans about 
the costs versus benefits of various health IT systems 
and that it would either encourage or require partici- 
pating providers to use systems that are consistent 
with sound management of federally managed or 
funded health care programs. Because the govern- 
ment is not concerned about competitive issues, its 
efforts with regard to health IT are not constrained 
by fears of benefiting health insurance plans in the 
private sector. 

The Centers for Medicare and Medicaid Services 
(CMS), which runs Medicare, has undertaken a 
number of initiatives and programs that encourage 
the adoption of health IT: 


■ The Medicare Care Management Demonstration 
provides financial incentives to medical practices 
on the basis of their performance on 26 measures 
of dinied quality. Physicians who use an elec- 
tronic health record (EHR) certified by the Certi- 
fication Commission for Healthcare Information 
Technology and who submit performance data to 
CMS electronically receive additional payments. 

■ In another demonstration announced in October 
2007. CMS will make bonus payments to small 
physician practices that use certified EHRs. All 
participating practices will be required to use a 
certified EHR to perform specific functions, such 
as clinical documentation and electronic ordering 
of prescriptions (c-prescTibing), that an positively 
affect die quality of patients' care. The core incen- 
tive payment to the practices will be based on their 
performance on measures of quality, with an 
enhanced bonus based on how well integrated the 
EHR b in helping physicians manage care. 

I In accordance with a recently passed law, CMS is 
implementing the Physicians Quality Reporting 
Inhume, through which physicians receive extra 
compensation for submitting data to CMS on the 
quality of the care they deliver. (Although physi- 
cians are not required to use health IT systems to 
prepare and transmit those reports, such systems 
facilitate that reporting.) 

■ CMS is working with Medicare Advantage plans, 
the program’s managed care option, to encourage 
them to offer personal health records (described in 
the appendix) to their members. 


Continued 
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Box 2. Continued 

The Federal Governmenl's Activities as a Payer 


■ CMS published a rule in 2006 and recently pro- 
posed another that would establish standards for 
e-prescribing for the Medicare program. The rules 
do not require providers to use e-prescribing in 
their practices; however, if providers are planning 
to use such an application to prescribe medication 
lor their Medicare patients, they must abide by the 
CMS standards. 

In addition to creating payment incentives to encour- 
age providers to adopt health IT, CMS a working— 
is arc a number of private health insurance plans— to 
develop policies for the use of health IT and stan- 
dards for the systems. For example, CMS is a mem- 
ber of the American Health Information Community 
(a federal advisory committee established by the 
Department of Health and Human Services, or 
HHS) and participates in many of its working 
groups. In 2007. CMS administered a total of 
$98 million in grants to states for the Medicaid 
Transformation program; the bulk of those grants 
were focused on implementing c-prescribing. EHRs, 
and the capability for health information exchange. 
CMS also provides technical assistance to small and 
medium-sized physician practices to help them 
obtain health IT systems and coaching for practices 
that acquire health IT practice management systems. 

Other federal agencies that purchase health care arc 
also involved in efforts to further the development 
and broad adoption of health IT. The Department of 
Defense (DoD), the Department of Veterans Affairs 
(V A), and the Office of Personnel Management 
(OPM) hast worked with HHS to adopt health 
information standards for use by all federal health 
agencies. As part of the Consolidated Health Infor- 
matics initiative, more than 20 federal agencies have 


agreed to endorse standards that enable information 
to be shared among agencies and that can serve as a 
model for the private sector. OPM has agreed to cre- 
ate incentives aimed at encouraging providers to 
adopt health IT in its contracts with insurers that 
participate in the Federal Employees Health Benefits 
Program. 

The VA and DoD are both extensive users of health 
IT. For several years, the VA has used an EHR. the 
Veterans Health Information Systems and Technol- 
ogy Architecture (VistA), in providing care to U.S. 
military veterans and. according to some empirical 
studies, has improved the efficiency of its health are 
delivery and the quality of the care it provides, lire 
VA has nude VistA an ‘open source’ system— avail- 
able to the public at no charge— thereby lessening the 
cost to providers of adopting health IT. 1 DoD has 
developed and is in the process of implementing an 
EHR— known as AHLTA (armed forces health longi- 
tudinal technology application!— for its health are 
system. Currently. AHLTA gives health are providers 
access to data about the conditions that beneficiaries 
arc being treated for and their prescriptions and diag- 
nostic tests, as well as additional information. DoD is 
also working with the VA to develop a way by which 
health information an be transmitted seamlessly and 
instantaneously between the two agencies. 


I. The opcn-wurce version of VistA ts known as TOxUVatA. 
Although it it fret, ii is a relatively sophisticated system that 
may he intimidating fix pmviden who have little experience 
with computer!. .An additional drawback for inch provider* 
is that World VistA may not come with the same lew) of on- 
cJ technical support and ocher similar types of assaulter 
that arc typically pan of the EHR peoducts of foc-peolit 
vendors. 
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The perceived loss of control of hcilth data that makes 
some proriders reluctant to adopt health IT may also 
nuke than hesitate to share information if they imple- 
ment EHRs m their practice. Such reluctance has been a 
major stumbling block in efforts to establish and main- 
tain regional health information organizations and to 
support greater exchange of health care information.’* 

Regulators Impediments 

State and federal regulations regarding beahb IT' are 
evolving. One major issue coocans federal rules related 
to donations of health IT that hospitals and ocher large 
prosidm mar warn ro male to providers with whom 
they work. Recent changes in such mb haw created so- 
called sale harbors that aliens those donations to take 
place without violating prohibitions on physician self- 
referrals. But some providers, payers, and other partici- 
pants in the health care sector may be reluctant to make 
or accept donations until the nib regarding them are 
dearer. 

The Departments of Health and Human Services (HHS) 
and Justice have attempted to clarify those rub, but 
other agencies, induding the Internal Revenue Service 
(IRS). are stil developing their regulations. The IRS has 
addressed the question of nonprofit hospitals' donations 
of health IT to physicians, but it it soD studying related 
issues, such as the uv-aor.pt sums of regional health 
information organizations and of organizations formed 
by payers and others id promote the adoption ot health 

IT. 

A major aspect of policymaking in regard ro health IT has 
to do with ensuring that proper safeguards are in pber to 
pro tea confidentiality and patients' privacy. The ability 
of beakh IT systems to speed the achange of dan and 
expand the amount of information that is shared also 
increases the risk that the confidentiality of pasonal 
health care information could be compromised (although 
in one sense EMR and other systems could lessen that 
risk by making it easier to monitor who accesses a per- 
sons medical record). Efforts to clarify and update federal 
and state laws regarding privacy are mxD under way. but 
the find form of those laws is uncertain— another factor 
that could be constraining the widespread adoption of 
health IT. 
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The Federal Role in Implementing 
Health Information Technology 

The federal government is both a purchaser of health are 
services and a regulator of health IT. As a purduscr, the 
government has an interest in improving the quality and 
the value of rhe care provided by Medicare, Medicaid, 
and other federal health are programs (which together 
account for about one-third of tool national expendi- 
tures on health are). If, indeed, health IT improves the 
quality of are while lowering its costs, then the federal 
government as a payer might consider actions that would 
facilitate the adoption of health IT. as long as the costs of 
those xtions did not exccrd the usings expected from 
them or the value of the improvements in are. (Box 2 oa 
page 22 describes federal activities retiring lo the govern- 
ments role as a purchaser of health are services.) 

As a regulator, the government is helping coordinate and 
facilitate the development anJ use of health IT. In gen- 
eral, its regulatory actions have been limited to functions 
(such as derdoping standards for interoperability) that 
would appear ro be more difficult, more time-consuming, 
or more costly than those that the private sector could 
deal with oa its own. (Bax 3 describes federal aaivitia 
relating to the government s rede as a regulator.) 

Issues for Coitsidcralioa 

.As the prominence of health IT has grown— in terms of 
its potential for increasing the efficiency and improving 
the quality of beakh are— policymakers haw debated 
the appropriateness of the federal government's being 
invoked in stimulating and guiding its adoption. Two 
factors lend support for such a role. The first is the federal 
government's position as a major purchaser of health care 
services through such programs as Medicare and Medic- 
aid. As the manager of those programs, the govtmmenr is 
responsible for running them efficiently and maintaining 
a btl of quality in their services that reflects the views of 
the electorate as expressed by policymakers. As a payer, 
the federal government assesses the benefin and costs of 
beakh IT in its various forms, determines which elements 
of the technology should be required to run federal health 
care financing programs efficiently and at the desired 
level of quality, and ukes appropriate steps to achieve the 
level of use of health IT that meets those criteria. 

The second factor lending support to posable federal 
intervention in furthering adoption of health IT is that 
the technology has some characteristics of a public 
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Box 3. 

The Federal Government's Activities as a Regulator and Funder 


The Department of Health and Human Service* 
(HHS). through the Office of the National Coordi- 
nator for Health Information Technology (ONC), 
leads the federal governments efforts to encourage 
the adoption of health information technology 
(hcalth IT). ONC s primary responsibilities are to 
coordinate the development of standards for health 
IT systems to ensure interoperability (the systems' 
capability to communicate with each other) and the 
development and implementation of a national 
health information network through which inter- 
operable health information can be exchanged. (For 
additional information, see Box 1 on page 1) 

To help spur adoption of health IT. HHS has estab- 
lished a new rule— which was developed by the Cen- 
ters for Medicare and Medicaid Services and the 
HHS inspector general— to make it easier for hospi- 
tals and other entities to give health IT systems to 
physicians. (The incentive for a hospital to provide 
health IT equipment and technical assistance to phy- 
sicians who arc associated with it is that such inter- 
operable health IT systems may enable the hospital to 
better control its costs and improve the quality of the 
are it provides.) The new rule aeates two new 
exceptions to a so-called physician ‘self-referral" law. 
which prohibits a physician— unless an exception 
applies— from referring Medicare patients for certain 
designated health services to entities with which the 
physician has a financial relationship. The two new 
exceptions are as follows: First, entities that furnish 
the designated health services may give to physicians 
interoperable electronic health record (EHR) soft- 
ware. information technology, and training services; 
and second, hospitals and other entities may provide 
physicians with hardware, software, or other informa- 
tion technology- and training necessary and used 
solely for the electronic prescribing of mediations. 
The rule also specifics that recipients of such health 
IT donations pay at least 1 5 percent of the price of 
the system. 


HHS has also supported the development of health 
IT through grams administered by ONC and die 
activities of other HHS agencies. The department has 
funded efforts to enhance the privacy and security of 
personal health information, promote antifraud 
activities for EHRs, support the development of stan- 
dardized measures of adoption for such records, and 
organize groups of qualified experts to advise the fed- 
eral government m its activities concerning the clini- 
cal decision support feature of many EHRs. The 
Agency for Healthcare Research and Quality within 
HHS funds research and development to support and 
stimulate investment in health IT, especially in rural 
and underserved areas. The agency also created the 
National Resource Center for Health Information 
Technology, which provides technical assistance on 
health IT. The Health Resources and Services 
Administration within HHS provides technical assis- 
tance as well to health centers and other grantees in 
adopting model practices and technologies. 

HHS has also provided funds to other entities. In 
2005. it established the American Health Informa- 
tion Community (AHIQ. a federal advisory com- 
mittee made up of public- and private-sector leaden 
who represent a broad spectrum of halth care stake- 
holders. AHIC was established to make recommen- 
dations to the Secretary of Halth and Human Ser- 
vices on how to make health records digital and 
interoperable and ensure that the privacy and security 
of the records arc protected; it b charged with accom- 
plishing those goals bv reiving as much as possible 
on the private sector. (Other private-sector entities 
established with the assbtancc of HHS funding 
include the Health Information Technology Stan- 
dards Panel and the Ccnifiation Commission for 
Healthcare Information Technology-, see Box 1 for 
additional information.) 
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Options for Federal Efforts to Promote Adoption of 
Health IT 

If the federal government chose to intervene directly to 
promote the use of health IT, it could do so by subsidiz- 
ing that use or by requiring it. Steps might indude, for 
example, having Medicare pay an additional amount per 
billed service to providers who used EHRs or requiring 
that providers who wished to participate in Medicare 
obtain an EHR by a specified date or pay a penalty. From 
a budgetary perspective, the subsidization approach is less 
likely to generate cost savings for the federal government 
because of the direct budgetary’ costs of the subsidy. 

Paying a bonus to providers that used health IT (in an 
amount less than or equal to the value of the providers’ 
use of the technologies) would enable practitioners to 
capture more of the benefits that their use of health IT 
would produce and give them a stronger financial incen- 
tive to invest in a system. But that approach would be 
likely to lead to a net cost for the government— and pos- 
sibly a large one. Even a small bonus could be expensive 
because it would be paid not only to those providers who 
newly purchased health IT but also to providers who 
already had such systems. Because a small bonus would 
attract relatively few takers, the bulk of the bonus would 
be paid to providers that already had health IT. A large 
bonus would entice more new purchasers, but it would 
add further to the overall net cost of the federal subsidy. 
(An alternative approach might be to target a subsidy to 


various types of providers, the amount of which would 
depend on their ability to capture the financial benefits of 
health IT. Thus, providers who were associated with staff- 
model HMOs and other highly integrated organizations 
would receive relatively small subsidies, whereas solo 
providers would receive relatively larger amounts.) 

A mandate to purchase health IT, or to purchase a partic- 
ular functionality such as e-prescribing, by contrast, 
would probably induce nearly all providers to adopt it at 
a small cost to the government, and might produce net 
uvings in health care spending. The requirement could 
be enforced either by not paying providers who failed to 
adopt such a system for other health care services that 
they delivered, or by imposing a specific penalty on those 
who did not comply. A less prescriptive version would 
involve paying providers without a health IT system less 
for any given procedure than providers with a health IT 
system were paid, which would create an implicit penalty 
for failing to adopt the technology. Either of those 
approaches, though, would come at a cost to providers, 
and that cost would be greatest for providers who were 
least able to capture the financial benefits of health IT 
systems. If policymakers are interested in promoting 
health IT, some version of a requirement or an explicit or 
implicit penalty for providers who fail to adopt health IT 
is likely to be more cost-effective for the federal govern- 
ment than a subsidy. 
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Appendix: 

Common Terms in 
Health Information Technology 


Health information technology (health IT) is a broad 
term that is commonly used to describe the use of com- 
puters and electronic applications in providing and docu- 
menting medical cate. The most common health IT 
terms include several typo of health records— the elec- 
tronic medical record (EM R), the electronic health record 
IEHR), and the patient health record IPHR) — as well as 
com patented physician order entry (CPOE), clinical 
decision support (CDS), dearonk prescribing (e» 
prescribing), and interoperability. LMRs. particularly 
those in hospitals, in many cases include CPOE and CDS 
applications. Aho pan of the health IT landscape arc the 
health information adunges (HIEs) and regional health 
information organizations iRHIOs). 1 

The eltamu m tdta! mWis equivalent to the paper- 
based medical record that a health care provider main- 
tains for a patient. The National Alliance for Health 
Information Technology defines it at *|a| computer- 
accessible resource of medical and administrative infor- 
mation available on an individual collected from and 
accessible by providers involved in the individual's care 
within a single care setting.* The LMR contains demo- 
graphic information and clinical data (related to the prac- 
tice of medicine) on the individual, including informa- 
tion about medications, the patient s medical history, and 
the doctors clinical notes (Moshman Associates. Inc. and 
Booz .Allen Hamilton. 2006). The LMRs curttndy in use 
vary considerably. Bask systems include patient informa- 
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cion, doctors’ dinical notes, and results firoen diagnostic 
tests. Systems that are more sophisticated also include 
such features as c-prescribing and warnings about drug 
and allergy interactions. The most advanced LMRs add 
CPOE (see below), registry functions that support popu- 
lation management, and clinical decision support.* The 
variation in what different LMRs an provide his compli- 
ated measurements of the rate of their adoption and led 
to seemingly contradictory estimates. 

An rleftmu btthb mtrJ a defined as *(a] computer- 
accessible. interoperable [set below] resource of clinical 
and administrative information pertinent to the health of 
an individual.' An EHR differs from an LMR in that 
information is drawn from multiple clinical and adminis- 
trative sources and usd primarily by a broad spectrum of 
dinical personnel imolvd in the individuals care, 
enabling them to deliver and coordinate cate and pro- 
mote the person’s wellness. .Any ambulatory-are EMR 
that meets the certification requirements of the Certiffa- 
tion Commission for Halihare Information Technology 
(sec Box I on page 2 for mote information) and that 
includes access to data sources beyond the physician’s 
office would be termed an dearonk health record with 
the EMR embeddd in it. Despite their differences, the 
terms ‘EMR* and "EHR” areofien usd interchangeably. 

A fmuul ixihb rmi is another type of dearonk 
record that is distinguishd in pan by who controls it: A 
PHR is controlled by the patient, whereas the EHR is 
controlld by the provider. The PHR is deiind as *[a| 
computer-accessible, interoperable [sec below] resource of 
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pcnincnt health information on an individual. Individu- 
al manage and determine the nghts to the access use, 
and control of the information. The information o op- 
ium ftom multiple sources and is used In' individuals 
and their authoeiaed dinfoal and wellness professionals to 
help guide and makr health decisions.' In contrast to the 
EHR, in which providers enter data, people who use a 
PHR manage the data contained in it. As a result. the 
quality and comprehensiveness of the information in a 
PHR vary considerably, depending on how much effort 
the patient wish© to expend and his or her access to data. 

PHRs mas- and frequently do include data on insurance 
claims for medical services that the patient has received. 
(Some health insurance plans ncm pcovidc PHRs to their 
members and insert their claims data.) By comparison, 
EHRs typically contain data that are more clinical in 
nature, such as the physician's notes on treatment or ser- 
vices provided. (They may also contain data from other 
providers if the patient was referred to a specialist. ) In 
essence, the PHR s data arc broad but not especially deep, 
whereas the EHRs data are less broad but much deeper. 
The PHR. however, has the potential to be the basis for 
the electronic health record, the repository for all health 
data on a particular patient. 

Many health plans and some employers now offer the use 
of PHRs to their members or employees, but while such a 
record can be a benefit to consumers, it may also raise 
questions about who owns the record, how it can be used, 
and whether the data in the record can be transferred if 
the person switches health plans or emglopm. Firms such 
as Google and Microsoft ire now (or soon will be) offer- 
ing a PHR product. 

A jwirr-foW A akb rmrJ (PBHR), jet another type of 
cicctrooic health record, is owned and administered by a 
health plan. It includes whateser data arc available to the 
health plan but primarily those related to claims. It may 
also include demographic information provided by the 
patient at the time of enrollment. It does not contain 
dmkal notes; however, owing to the increasing amount 
of data required in submitting claims to payers, a PBHR 
may comprise laboratory results, radiological trading), 
prescriptions, aid complete reports for inpatient and out- 
patient hospital care, as well as other types of informa- 
tion. A PBHR may be useful— for example, when a 
patient visits a hospital emergency room— because hospi- 
tal staff can access the record to obtain critical data on the 


patient, such a information that could help prevent 
adverse drug events. 

G*[*UTUfJ pburin infer nttrj systems are electronic 
appfcations that physicians use to order medications, 
diagnostic (laboratory and radiology) tests, and ancillary 
services (Poon and others, 2001). Typkaly, such systems 
arc used in hospitals, often with an EHR; however, many 
outpatient EHRs also provide CFOE functions. Because 
EHRs and CFOE arc so often connected in hospitals, a 
facility's health IT system may be described as cither an 
EMU an EHR. or a CPOE system, adding to the confu- 
sion over what system the hospital is actually using. 
fStudio that examine the effects of health IT in hospitals 
often measure reductions in duplicate orders for labora- 
tory tests, and those reductions are possible only if the 
hospital has both an EHR and a CPOE system.) 


Clw/1 (fertuM npfon systems art often used in combi- 
nation with CPOE functions in hospitals to assist physi- 
cians with decisionmaking by providing reminders, sug- 
gestions. and support in diagnosing and treating diseases 
and conditions. The range of features that CDS systems 
offer includes drug-dosing assistance, checks for drug 
allergies and drug-drug interactions, access to the latest 
evidence-based protocols, reminders about petvemive- 
medkine tests, and guidance for complex antibiotic man- 
agement programs. Both CPOE and CDS systems vary 
considerably in their complexity and capabilities. 

E-fnxribint is the electronic transfer of a prescription 
from the prescribing physicians office to die pharmacy, 
which allows a patient to make only a single trip to the 
pharmacy to pick up the prescription once it has been 
filled. E-prescribing has received a great deal of attention 
but is not my common. Many physicians who have 
EHRs in place could cash' generate prescriptions using 
the electronic record— and thus benefit from the CDS 
function that many EHRs include— but in the end they 
often print out a prescription for the patient to take to 
the plumucy. Using the EHR to generate a paper pre- 
scription may reduce transcription errors and reduce the 
physicians time and effort, but the patient must still 
deliver the prescription to the plurality. 

Iwnptnhikt) describes the capacity of one health IT 
app&arion to share information with another in a com- 
putable format (that is. for example, not simply by shar- 
ing a PDF [portable document format] file). Sharing 
information within and xross health IT tools depends on 
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Chairman STARK. Thank you. 

Dr. Ejnes. 

STATEMENT OF YUL D. EJNES, M.D., CHAIRMAN, MEDICAL 
SERVICES COMMITTEE, AMERICAN COLLEGE OF PHYSICIANS 

Dr. EJNES. Thank you, Chairman Stark and Ranking Member 
Camp. My name is Yul Ejnes, M.D. FACP. I serve on the American 
College of Physicians Board of Regents. I am a general internist in 
private practice in Cranston, Rhode Island, and I am also a Mem- 
ber of the medical faculty at Brown University. 

Representing 126,000 internal medicine physicians and medical 
students, we share your optimism that health information tech- 
nology can improve health care. Many studies have found that full 
adoption and utilization of HIT can improve quality and reduce 
high medical costs. Patients who are fortunate enough to have a 
physician who is supported by electronic health records and other 
information systems are more likely to receive better coordinated 
care, and be less likely to be exposed to medical errors. 

Duplicate tests and drug interactions can be prevented. Better 
coordinated care supported by HIT enables physicians to partner 
with their patients to prevent complications that lead to avoidable 
hospital admissions, particularly for patients with multiple chronic 
illnesses. 

My 50-physician group practice has an electronic health record, 
or EHR. Our practice leadership is tech-sawy, and we’re fortunate 
to have received some support from a forward-looking private 
payer. So, with these favorable factors, you would think that our 
decision to implement an EHR was simple. On the contrary, it took 
us 10 years. We have been using our EHR for two years now, and 
have found that the challenges associated, especially the cost and 
impact on workflow, and the lack of true interoperability to be very 
substantial. 

The other challenges are not nearly as great as they are for phy- 
sicians in smaller practices. Of the ACP Members involved in direct 
patient care after training, approximately 20 percent are in solo 
practice and 50 percent are in practices of 5 or fewer physicians. 
Three-fourths of all Medicare recipients receive their outpatient 
care from smaller physician practices. These are the physicians 
who already lag in HIT adoption, and are least likely to have the 
necessary capital on board to invest in technology. 

Acquisition costs can average up to $44,000 per physician. The 
average annual ongoing costs are about $8,500 for a physician. For 
many of those practices, the business case for making such a large 
investment simply doesn’t exist. Public and private payers, not the 
physicians, realize much of the savings from physician investment 
in acquiring the necessary HIT. 

Mandating use of HIT, especially in the absence of positive finan- 
cial incentives and lack of uniform standards of interoperability 
and functionality will likely drive the physician practices we need 
the most out of business. Positive incentives are the answer. 

ACP specifically recommends that Congress build into the Medi- 
care physician payment system an add-on code for office visits and 
other services when supported by certified HIT. The amount of the 
add-on should relate to the complexity of HIT adopted by the prac- 
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tice, similar to how bridges to excellence provides increasingly 
higher payments to practices as they acquire and use more ad- 
vanced information systems. Congress should continue to support 
the establishment of the standards needed to allow true interoper- 
ability. 

For example, while my EHR has provided great benefit, we can’t 
yet incorporate test results from outside laboratories in electronic 
searchable form, due to lack of interoperability. Congress should 
continue to advance the patient-centered medical home, or PCMH 
model, as a means of rapidly driving primary care practices to ac- 
quire the information systems and other capabilities needed to pro- 
vide patient-centered and coordinated care. 

We appreciate the support of Chairman Stark and other Mem- 
bers of this Subcommittee for the increased funding for the Medi- 
care medical home demo that was included in H.R. 6331, and for 
the inclusion of provisions in the CHAMP Act to further advance 
this model. 

NCQA has developed a qualification process to provide an inde- 
pendent assessment of the capabilities of practices to provide co- 
ordinated care, including the degree by which they are using HIT 
in order to participate in a medical home demo. This process, for 
instance, looks at whether a practice has registry systems to track 
patients by disease conditions, or to generate patient reminders. 

ACP specifically recommends that Congress transition from the 
limited medical home demonstration in eight states to a national 
pilot, as the Medicare payment advisory Committee has rec- 
ommended. 

Should the pilot show that the medical home model can improve 
quality, achieve savings without compromising quality, or both, 
Congress should require the Secretary of HHS to develop and im- 
plement a new payment system for any practice that has the capa- 
bility to be a medical home. This would consist of a monthly risk- 
adjusted care management fee that would take into account how a 
practice is advanced in acquiring HIT, continued fee-for-service 
payments for visits, and a performance-based component for report- 
ing on quality. 

We also encourage Federal support for regional and statewide 
HIE, health information exchanges. Many of the potential benefits 
of physicians adopting EHR’s won’t be realized until we do so. 

So, in summary, we commend Chairman Stark and Members of 
the Committee for holding this important hearing. ACP believes 
that Congress should build into Medicare payment policy, increased 
payments for practices that acquire and use HIT to improve qual- 
ity, especially those that demonstrate the capability of being a 
medical home, and provide access to Federal funding for initial ac- 
quisition costs. 

Without financial incentives, small practices and their patients 
will be left behind the technological curve. Thank you. 

[The prepared statement of Mr. Ejnes follows:] 

Prepared Statement of Yul D. Ejnes, M.D., Chairman, Medical 
Services Committee, American College of Physicians 

I am Yul Ejnes, MD, FACP. I am a practicing general internist in Cranston, 
Rhode Island. I am a member of the medical faculty at Brown University and serve 
on the Board of Directors of the Rhode Island Quality Institute, the state’s Regional 
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Health Information Organization (RHIO). I am also a member of the Board of Re- 
gents of the American College of Physicians (ACP), and chair of the College’s policy 
committee that has overall responsibility for both payment-related policies and 
health information technology (HIT). I am pleased to present ACP’s views on the 
adoption and use of HIT. 

ACP, representing 126,000 internists and medical students, is the largest medical 
specialty society and the second largest medical organization in the United States. 
ACP commends Subcommittee Chairman Fortney “Pete” Stark and Ranking Mem- 
ber Dave Camp for holding this hearing on the adoption and use of HIT. We share 
the optimism conveyed in the announcement of this hearing by Chairman Stark, 
that HIT has the potential to improve quality of health care and reduce costs. We 
commend the Subcommittee for specifically focusing on the need for incentives to 
facilitate HIT adoption and use. 

Introduction 

The Institute of Medicine’s (IOM) 2001 Report, “Crossing the Quality Chasm — A 
New Health System for the 21 st Century ,” suggested that up to 98,000 Americans die 
each year as a result of medical errors. The report introduced the notion that many 
of these lives could be saved through information technology. Since then, numerous 
studies and other policy experts have confirmed that full adoption and utilization 
of HIT has the potential to result in major gains in health care quality of care and 
patient safety. 1 Some studies have also concluded that HIT can achieve very sub- 
stantial reductions in health care costs. 2 Even skeptics who are less certain about 
the ability of HIT to lower costs recognize that providing physicians and other clini- 
cians with access to information systems to help them manage and coordinate pa- 
tient-centered care, especially for patients with multiple chronic diseases, offers the 
potential of achieving gains in quality and overall savings. 3 

The Congressional Budget Office (CBO) May 2008 paper “Evidence on the Costs 
and Benefits of Health Information Technology” states that HIT generally refers to 
the use of computer applications in the practice of medicine. It notes that those ap- 
plications (including clinical decision support and electronic prescribing) can be 
housed in an electronic health record (EHR). 4 While physicians can use individual 
HIT applications independent of an EHR, use of an EHR is often used to measure 
HIT adoption. 

Benefits of Health Information Technology 

The benefits of HIT that are most often cited are: avoidance of medical mistakes; 
storage and preservation of medical data; avoidance of medical errors; reductions in 
malpractice premiums; and improved quality outcomes. 5 We elaborate on each of 
these benefits below. 

• Medical Mistake Avoidance I Provision of Recommended Care: The use of clin- 
ical-decision support tools at the point of care has the potential to offer a tre- 
mendous advantage to both physicians and their patients by facilitating rec- 
ommended evidence-based preventive, acute, and chronic care. Examples of 
this benefit include alerts about vaccinations, anti-coagulation reminders, dia- 
betes, hypertension, thyroid and anemia screening in the elderly, health 
maintenance and preventive care measures. HIT can also be an important 
conduit for providing clinicians with unbiased information on the comparative 
effectiveness, clinical as well as cost, of different treatments, a topic that the 
ACP has addressed in some detail in a new position paper on comparative 
effectiveness. 

• Storage of Other Encounter Data: An often-cited example is the disappearance 
of paper medical records and charts following Hurricane Katrina. Having 
medical data stored electronically assures the safe keeping of complete med- 


1 DesRoches, Catherine, et al., "Electronic Health Records in Ambulatory Care — A National 
Survey of Physicians”, New England Journal of Medicine, July 3, 2008. 

2 RAND Health, “Health Information Technology: Can HIT Lower Costs and Improve Qual- 
ity?,” Research Highlight, at http://www.rand.org/pubs/research briefs/RB9136/ 

RAND RB9136.pdf. 

3 Sidorov, Jaan, “It Ain’t Necessarily So: The Electronic Health Record and the Unlikely Pros- 
pect of Reducing Health Care Costs,” Health Affairs, July/August 2006. 

4 Evidence of the Costs and Benefits of Health Information Technology, Congressional Budget 
Office, May 2008. 

5 Sidorov, Jaan, “It Ain’t Necessarily So: The Electronic Health Record and the Unlikely Pros- 
pect of Reducing Health Care Costs,” Health Affairs, July/August 2006. 
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ical histories that can be difficult to duplicate from memory. In addition, 
when patients become incapacitated, storage of the data can be critical. 

• Medication Error Avoidance: The use of electronic prescribing (e-prescribing) 
offers promise because it eliminates problems with bandwriting legibility and, 
when combined with decision-support tools, automatically alerts prescribers 
to possible interactions, allergies, and other potential problems. E-prescribing 
can also increase appropriate use of generic drugs. We note, however, the e- 
prescribing systems will be more effective if they are integrated with fully 
functional electronic health records. 

• Quality Improvement, Patient-Centeredness, and Care Management: As noted 
earlier, HIT offers the potential to help physicians improve overall health care 
quality by having evidence-based clinical decision support at the point of care, 
generating patient reminders, providing access to more complete information, 
and reducing drug interactions. It can also have the benefit of preventing un- 
necessary and duplicative testing, helping patients achieve improvements in 
their own health care, delivering patient centered services (such as remote 
monitoring, secure access to email consultations), and reducing fragmentation 
in health care services that may increase costs and result in poorer outcomes. 
Further, it can shorten hospital stays or help avoid them altogether. It also 
enhances the ability of physicians to track and measure the quality of care 
they provide to their patients. 

Status of Physician Health Technology Use 

Despite the tremendous upside associated with HIT, relatively few physician prac- 
tices have it — with small practices having the lowest rates. A 2006 review by the 
Robert Wood Johnson Foundation found that approximately 24% of physicians in 
ambulatory practice have an EHR, with a solo physician practice adoption rate of 
only 13% to 16%. 6 A 2006 ACP member survey demonstrated that practices with 
five or fewer physicians have a significantly lower EHR adoption rate (18%), than 
practices with 20 or more physicians (58%). 7 Other studies have shown that while 
EHR use is rising slowly, adoption by small practices continues to lag. 8 

Barriers to Physician Health Information Technology Use 

The barriers to the acquisition and use of HIT, especially for small physician prac- 
tices, are numerous, with the major obstacles described below. 

• Substantial Cost in Acquiring and Maintaining the Technology: Depending on 
the size of the practice and its applications, acquisition costs, on average, 
$44,000 per physician. The average annual ongoing costs of maintenance and 
support are about $8,500 per physician. 9 Physicians cite these costs are the 
largest adoption barrier. 10 In addition, there are costs associated with train- 
ing and lost productivity. In a 2005 study, 14 small practices implementing 
a HIT system experienced a decline in revenue because of lost productivity 
of $7,500 per physician. 11 Collectively, investment and maintenance is a fi- 
nancial commitment that spans the life of the practice. This obstacle is espe- 
cially acute for physicians in small practices, where three-fourths of all Medi- 
care recipients receive outpatient care. 12 

• HIT Savings Accrue to Others and Not the Physician Making the Investment: 
Public and private payers generally realize the financial benefit associated 
with HIT use, which can come in the form of a reduction in duplicative or 
unnecessary care, the avoidance of costly medical errors, a reduction in hos- 
pital days, an improvement in quality outcomes, and lower administrative 
costs. 


6 The Robert Wood Johnson Foundation (2006), Health Information Technology in the United 
States: The Information Base of Progress, chapter 3, p. 26. 

7 American College of Physicians, E-Health and Its Impact on Medical Practice. Philadelphia: 
American College of Physicians; 2008: Position Paper. 

8 Jha, Ashish K., Ferris, Timothy G., et al., “How Common Are Electronic Health Records in 
the United States? A Summary of the Evidence,” Health Affairs, web exclusive October 11, 2006. 

9 Miller, Robert, West, Christopher, et al., “The Value of Electronic Health Records in Solo or 
Small Group Practices.” Health Affairs, Vol. 24, No. 5, September/October 2005. 

10 DesRoches, Catherine, et al., “Electronic Health Records in Ambulatory Care — A National 
Survey of Physicians”, New England Journal of Medicine, July 3, 2008. 

11 Miller, Robert, West, Christopher, et al., “The Value of Electronic Health Records in Solo 
or Small Group Practices.” Health Affairs, Vol. 24, No. 5, September/October 2005. 

12 Center for Studying Health System Change, “Most Medicare Outpatient Visits Are to Physi- 
cians With Limited Clinical Information Technology,” July 2005. 



58 


• Lack of True Interoperability: Physicians lack confidence that an EHR will be 
able to communicate with an information system used by another clinician, 
hospital, laboratory, or other entity. Manual integration of information from 
disparate sources requires additional work and prevents full using EHRs to 
their full capability. This situation discourages EHR adoption. 

• Medicare and Other Payment Systems Generally Incentivize Volume over 
Quality: Paying physicians on a per-procedure or per-service basis encourages 
volume and actually may act as a disincentive to acquire information systems 
that can result in the more efficient provision of services. For example, a phy- 
sician receives less financial compensation if he or she refrains from con- 
ducting a test known to be duplicative because of HIT. Medicare payment 
policies for the most part are, at best, neutral on acquisition and use of HIT, 
except for some limited reporting of “structural” measures in the Physician 
Quality Reporting Initiative (PQRI) and several Medicare demonstration 
projects that provide reimbursement incentives for HIT. Medicare also sys- 
tematically undervalues primary care services, making it particularly difficult 
for primary care doctors whose practices may be struggling and near the 
breaking point to spend the money needed to acquire HIT. 

• Uncertainty Surrounding Medicare Physician Payments: The flawed mecha- 
nism for updating Medicare payments to physicians, the Sustainable Growth 
Rate (SGR) system, is a complicating factor. The system — and its need to be 
perpetually corrected, makes planning for significant practice investment a 
challenge. We appreciate the congressional action, despite the budget chal- 
lenge and other obstacles, to avert what would have been a devastating 10.6% 
across-the-board cut in physician payments that was set to begin on July 1, 
2008 and substituting the additional 5.4% cut slated for 2009 with a 1.1% in- 
crease. This action provides some stability and buys time to fashion a long- 
term legislative solution. The relatively modest increase, especially consid- 
ering rising practice costs, and the uncertainty regarding payment updates 
beyond 2009 make it difficult for practices to make the investment in EHR 
and other HIT. ACP also recognizes and appreciates that the Children’s 
Health and Medicare Protection (CHAMP) Act — reported out of the Ways and 
Means Committee, with the support and leadership of Chairman Stark, and 
that passed the House of Representatives in 2007 — would have provided fur- 
ther relief from the SGR cuts and improved payments for primary care serv- 
ices had it become law. 

In sum, for many physicians, the business case to invest in EHR/HIT simply does 
not exist. Even so, there are physicians who have become early adopters even 
though the economic case for doing so is poor. 

I have had an EHR in my own medium-sized practice for the past two years and 
have been writing prescriptions electronically for the past five. I made this invest- 
ment because I felt it was in the best interests of my patients, even thought it was 
not necessarily in the best interest of my practice’s “bottom line.” But, I fully under- 
stand why so many of my colleagues have deferred making such an investment 
given the poor business case to support it and the lack of any reimbursement incen- 
tives for doing so. 

The Need for Congressional Involvement 

The complex issues surrounding financing, assistance with redesign of practice 
workflow, and ongoing technical support and training must be recognized and ad- 
dressed for the goal of widespread adoption and use HIT to be realized. ACP strong- 
ly believes that the Congress has an important role to play in overcoming the chal- 
lenges posed by these issues, particularly pertaining to physicians in small prac- 
tices. 

Both Medicare and the private sector have recently provided some incentives to 
facilitate HIT adoption and use. Unfortunately, the programs are limited to far too 
few physicians. These experiences do, however, demonstrate physician interest and 
provide reasonable assurance the physicians will respond to adequate incentives. 
This should provide Congress with a level of comfort that physicians will use incen- 
tives if they are made available to more physicians. 

The Bridges to Excellence (BTE) program that encourage practices to maintain 
structural capability, including HIT components, aimed at improving patient care 
provides an example of physician practices responding to financial incentives. BTE 
is a coalition that encourages leaps in quality of care by recognizing and rewarding 
health care providers who demonstrate that they provide safe, effective, efficient, 
and patient-centered care. The BTE program pays physicians who are recognized 
under the National Committee for Quality Assurance (NCQA) Physician Practice 
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Connections Physicians Office Link (PPC-POL) program as having the systems to 
improve care up to $50 per patient per year. Over 1,500 physicians are recognized 
through the NCQA PPC program, with an average practice size of 5 physicians. This 
shows that small physician practices are responsive when financial incentives are 
aligned with the transition to this type of care. 

Beginning January 2008, BTE started to make bonus payments to practices in eli- 
gible areas that earn NCQA PPC-POL or PPC Patient Centered Medical Home 
(PPC-PCMH) recognition, plus the required recognition for other condition-specific 
modules (e.g. diabetes, heart/stroke). This is evidence of the growing interest of the 
PCMH and the willingness of the private sector to provide incentives to encourage 
practices to pursue PCMH recognition. 

Recommended Financial and Other Incentives 

Many physicians’ small practices will be unable to acquire and use HIT without 
sufficient financial assistance from the Federal Government. Leaving behind these 
practices, from which the majority of Medicare beneficiaries receive their care, will 
prevent the goal of widespread use of fully integrated technology from becoming a 
reality. 

We caution Congress, though, against trying to mandate HIT use, especially given 
the lack of financial incentives to help practices. For many small practices, an un- 
funded mandate to acquire and use HIT could literally put them out of business. 
It is also does not make sense to mandate HIT given that issues relating to inter- 
operability, standards, and functionality have yet to be fully resolved. Mandates are 
not sensitive to differences in practice resources, patient case mix, staffing ratios, 
geographic locations, ownership, and a myriad of other factors that will affect the 
ability of practices to acquire and use HIT. A practice that is part of a large aca- 
demic system, large group practice, or owned by a hospital is very different from 
a small physician-owned practice. 

We instead recommend that Congress establish targeted financial incentives 
aimed at facilitating HIT in small practices. Specifically, ACP recommends that the 
Congress take the steps below to provide the financial incentives necessary to facili- 
tate widespread HIT adoption and use. 

• Establish an Add-on Payment for Evaluation and Management Services: The 
College recommends establishing an add-on code for office visits and other 
evaluation and management (E/M) services when the visit is supported by 
qualified HIT systems. The payment mechanism should make it possible for 
the physician to report that the E/M service was supported by HIT. The 
amount of the add-on should relate to the complexity of HIT adopted by the 
practice. For example, Medicare could establish three levels or tiers of HIT 
adoption, similar to the NCQA PPC-POL module. The level of the add-on 
then would depend not only on whether the physician had the information 
systems in their office, but how those systems are used to improve patient 
care. A practice that had only a simple stand-alone e-prescribing system and 
patient registry would be paid less than one that had a fully functional EHR 
with e-prescribing, patient reminders, clinical decision support at the point of 
care, and the ability to measure and report on clinical performance measures 
imbedded in the system. 

• Include Reporting of Structural HIT Measures in Quality Reporting Programs: 
Medicare should reward physicians who incorporate either some or all aspects 
of HIT and participate in reporting on endorsed quality measures as part of 
the PQRI. We note that the PQRI currently includes a small number of struc- 
tural measures, and beginning in 2009, Medicare will begin providing bonus 
payments to physicians who are able to report that they are using an e-pre- 
scribing system. 

• Pay Physicians a Care Coordination Fee if they Acquire and Use the Informa- 
tion Systems Needed to Function as a PCMH and Regularly Report on their 
Performance. The ACP recommendations on the PCMH are discussed in depth 
later in this testimony. 

• Assist Small Physician Practices with the Initial Investment to Acquire HIT: 
Congress should make available grants, loans, and/or tax credits to help prac- 
tices currently least able to purchase the necessary HIT hardware and soft- 
ware. ACP notes, however, that the impact of these incentives is limited ab- 
sent changes in Medicare payment policies to create incentives for HIT use. 

• Ensure Clear Guidance on the “Safe harbor” Exception to the Self-referral Pro- 
hibition: The law allows hospitals and other entities to assist physicians in 
acquiring HIT. The CBO May 2008 paper, “Evidence on the Costs and bene- 
fits of Health Information Technology”, notes that three federal agencies are 
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establishing rules related to this safe harbor and the lack of present clarity 
can be an impediment to HIT expansion. 

• Explore Mechanisms to Assist Practices in Implementing HIT: Physicians face 
significant challenges in selecting, integrating, and optimizing HIT. The Na- 
tional Ambulatory Medical Care Survey (NAMCS), an annual, government- 
funded, nationally representative survey of all ambulatory visits to physicians 
whose practices are not hospital-based, includes questions about EHR use. 
While the NAMCS found nearly 24% of physicians using EHRs, further anal- 
ysis determined that only 9% are using an EHR with at least the four key 
functionalities identified by the IOM. 13 Congress should facilitate resources 
that provide support throughout the HIT implementation continuum that will 
make selection less daunting, minimize productivity throughout implementa- 
tion, and result in optimal use. The College urges Congress to review the rec- 
ommendations/options in the October 2007 “eHealth Initiative Blueprint: 
Building Consensus for Common Action,” which is available at http :/ / 
www.ehealthinitiative.org/blueprint/eHiBlueprint- 
BuildingConsensusForCommonAction.pdf. 

• Support the Establishment of Standards to Facilitate Interoperability and Re- 
porting Quality Data: ACP strongly supports efforts by those in the Adminis- 
tration and the Congress to speed the adoption of uniform standards for HIT. 
In order to oversee the ten-year initiative to achieve widespread adoption of 
EHRs that President Bush announced in 2004, the Administration created 
the Office of National Coordinator for Health Information Technology (ONC). 
ONC and related initiatives are working toward establishing the standards 
necessary to provide physicians with confidence that their investment in HIT 
will be supported by sustainable processes and infrastructure that enable 
them to use HIT to the optimal benefit of the patient and system efficiency. 

• Support for Information Exchange Projects that Promote Interoperability: Con- 
gressional support for state and regional health information exchange efforts 
will move toward the true interoperability needed for physicians to use EHR 
products to their maximum potential and to achieve the greatest benefit to 
the health care system. 

Patient Centered Medical Home as a Means to Facilitate HIT and its Asso- 
ciated Goals 

ACP, like many others, believes that use of HIT alone will not enable the health 
care system to deliver improved quality in a way that maintains or lowers costs to 
its full potential. The College believes that HIT in the context of a Patient Centered 
Medical Home will yield the greatest benefit. ACP worked with the American Acad- 
emy of Family Physicians (AAFP), the American Academy of Pediatrics (AAP), and 
the American Osteopathic Association (AOA) to jointly establish principles that de- 
fine the PCMH. The PCMH is a delivery model that involves a patient with a rela- 
tionship with a personal physician who works with a practice team to provide first 
contact, whole-person, continuous care. The PCMH model is based on the premise 
that the best quality of care is provided not in episodic, illness-oriented care, but 
through patient centered care that emphasizes prevention and care coordination. A 
PCMH practice must demonstrate that it has the infrastructure and capability to 
provide care consistent with the patient’s needs and preferences. The PCMH joint 
principles call for enhanced payment to support the practice transformation and in- 
creased value to the patient and the health care system. 

ACP, AAFP, AAP, and AOA, as the four organizations that represent a significant 
number of primary care physicians, worked with the National Committee on Quality 
Assurance (NCQA) to establish an independent process by which physician practices 
can be recognized as a PCMH. The NCQA established process, the Physician Prac- 
tice Connections-PCMH (PPC-PCMH) module, requires practices to meet core re- 
quirements and attain a minimum score to be recognized as a medical home. Prac- 
tices that meet these core requirements and achieve at or above the minimum total 
score are identified as one of three progressive levels of PCMH. The highest level 
of medical home, a Tier 3 PCMH, is generally associated with the greater use of 
HIT. 

Having a process by which an independent, third-party determines whether a 
physician practice is a PCMH is one reason why the model has gained considerable 
traction over the past few years. Assurance that practices are transforming to meet 
the full needs of patients has contributed to the decision of many employers, health 


13 Institute of Medicine, “Key Components of an Electronic Health Record System: Letter Re- 
port,” July 2003. 
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plans, consumer organizations, policymakers, and other health care stakeholders to 
embrace the model. It is our understanding that CMS intends to use a recognition 
process to identify the medical home practices that participate in the Medicare med- 
ical home demonstration project authorized by Congress in 2006 and enhanced 
through the Medicare legislation that become law earlier this month. 

In its June 2008 Report to Congress, the Medicare Payment Advisory Commission 
(MedPAC) recommended that it establish a robust PCMH pilot project that focuses 
on practices that use significant HIT. 

We appreciate the Congress’s support of the PCMH and urge it to consider addi- 
tional payment reforms that incentivize the adoption and use of HIT in the context 
of the PCMH. We specifically recommend that Congress: 

• Provide Additional Funding to the Centers for Medicare and Medicaid Serv- 
ices (CMS) to Expand the Medicare Medical Home Demonstration to More 
Practices and States. ACP appreciates the $100 million in increased funding 
for the Medicare Medical Home Demonstration that was included in H.R. 
6331 but believe that even higher funding levels would enable the PCMH 
model to be expanded nationwide and evaluated as a national pilot rather 
than a limited demonstration project. We also believe that Congress should 
consider working from the medical home demonstration language and funding 
that was in the CHAMP Act as a basis for expanding the model into a na- 
tional pilot. ACP cautions the Subcommittee, however, not to delay the exist- 
ing demonstration even as it considers additional legislation to expand and 
test the PCMH on a national scale. 

• Require that the Secretary Transition to a New Payment Methodology for 
Qualified PCMH, should the Medicare Medical Home Demonstration be Suc- 
cessful in Improving Quality or Achieving Savings or Both: The alternative 
PCMH payment structure should pay PCMH recognized practices, including 
practices recognized through the NCQA PPC-PCMH voluntary recognition 
process or other equivalent process as determined by the Secretary, for the 
clinical work and practice expenses associated with providing care coordina- 
tion services, consisting of the following: 

• Prospective, risk-adjusted per beneficiary per month PCMH fee for each 
beneficiary that chooses that practice as their PCMH to cover the work 
and practice expenses involved in providing care consistent with the 
PCMH model (e.g. increased access, care coordination, disease population 
management and education) that are not currently covered under the 
Medicare Physician Fee Schedule. Such prospective, risk-adjusted per 
beneficiary payment should be set at a level and magnitude that is suffi- 
cient to support the acquisition, use and maintenance of clinical informa- 
tion systems needed to qualify as a PCMH and that have been shown to 
facilitate improved outcomes through care coordination. 

• The Secretary should consider the impact of qualified PCMHs on reduc- 
ing preventable hospital admissions, duplicate testing, medication errors 
and drug interactions, and other savings in Medicare Parts A, B (includ- 
ing Part B services not included in the Medicare Physician Fee Schedule) 
and apply a portion of the aggregate estimate of such savings to deter- 
mining the aggregate amount of payment for the PCMH fees that would 
then be provided to qualified practices. Should aggregate actual savings 
after three years be higher than the estimate, the Secretary should apply 
a portion of such additional aggregate savings to fund the PCMH fee. 

• Performance-based bonus fee determined by meeting specified clinical, 
patient satisfaction and efficiency benchmarks. 

• Continued fee-for-service payment for evaluation and management serv- 
ices. 

• Require Separate Medicare Payment for Designated Primary Care Services 
and Services and Capabilities that Promote Patient-centered Care: Congress 
should mandate that the Secretary pay for care coordination services provided 
by a primary or principal care physician to a beneficiary. Medicare should 
make separate payment for a comprehensive care coordination service de- 
scribed in a yet-to-be-defined procedure code(s). Medicare should also make 
separate payment for discrete services defined by existing procedure codes 
that describe a clinical interaction with a beneficiary that is inherent to care 
coordination, including interactions outside a face-to-face encounter. These 
services should include: 

• Care plan oversight; 

• Evaluation and management provided by phone; 

• Evaluation and management provided using internet resources; 
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• Collection and review of physiologic data, such as from a remote moni- 
toring device; 

• Education and training for patient self management; 

• Anticoagulation management services; and 

• Current or future services as determined appropriate by the Secretary. 

Estimating Savings from HIT Use and Other Promising Projects 

ACP believes that much of the additional expense involved in funding the finan- 
cial incentives it recommends in this statement can be covered by the anticipated 
savings that the improved care can generate. Congress should develop a mechanism 
to assess the system-wide savings that HIT and other innovative delivery and pay- 
ment reforms, such as the PCMH, that aim to improve quality generate. Savings 
can be used to help fund Medicare’s assistance to physicians with initial HIT invest- 
ment and on-going maintenance. 

In addition, we are encouraged that the Department of Health and Human Serv- 
ices is in the process of assessing the system-wide savings expected to be generated 
through the EHR demonstration project and the Medicare medical home demonstra- 
tion project. HHS intends to fund the enhanced payments to physicians partici- 
pating in the EHR demonstration project through the system-wide savings that it 
expects it to generate. HHS is determining the savings it expects the improved 
interventions that result from the Medicare medical home demonstration project 
will generate. It will use the expected savings to fund payments to individual physi- 
cians in PCMH practices for the enhanced services they provided to better coordi- 
nate patient care. Congress should monitor these important efforts to assess the im- 
pact of HIT and other promising reforms across the entire Medicare program, as op- 
posed to the historical tendency to assess changes within individual components of 
the Medicare program. 

We are troubled, however, by the CBO view, expressed in its May 2008 paper, 
that HIT will not likely reduce overall health care spending and that incentives may 
actually increase spending in the absence of mandates. This position goes against 
the views of many other experts who believe that HIT, especially if used to support 
patient-centered care coordination by primary care physicians, can improve quality 
and achieve efficiencies that decreases overall spending. The CBO position may 
itself become one of the greatest barriers to HIT adoption if it results in Congress 
being unwilling to provide the financial incentives needed to support HIT. 

We also note that most other industrialized nations have decided that it is nec- 
essary and appropriate to make large public investments in HIT. ACP recently pub- 
lished a position paper in the College’s peer-reviewed journal, the Annals of Internal 
Medicare, that compared the United States’ health care system with those of other 
industrialized countries. Citing data from the Commonwealth Fund and other 
sources, the paper found that compared with countries with well-performing health 
care systems, the United States lags seriously in the implementation of EHR sys- 
tems in office practice. Compared with primary care doctors in six other countries, 
U.S. physicians are among the least likely to have extensive clinical information sys- 
tems. In 2006, nearly all primary care doctors in the Netherlands (98%), and 79% 
to 92% of doctors in Australia, New Zealand, and the United Kingdom, bave EHR 
systems, while the rate was only 28% in the United States (and 23% in Canada). 
Most doctors in countries with high rates of EHR systems routinely use them to 
electronically order tests, prescribe medications, and access patients’ test results. 
Compared with doctors in the U.S. doctors in these countries are more likely to re- 
ceive computerized alerts about potential problems concerning drug dosages and 
interactions, have reminder systems to notify patients about preventive or follow- 
up care, and (except for the Netherlands) receive prompts to provide patients with 
test results. More than 60% of the doctors in the four countries with high EMR use, 
as well as those in Germany (where 42% have EMR systems), say it is easy to gen- 
erate lists of patients by diagnosis or health risk; in contrast, only 37% of U.S. doc- 
tors say it is easy, and 60% say it is somewhat difficult or worse to generate such 
lists. Likewise, doctors in countries with high rates of EMR systems are two-to-four 
times as likely to say it is easy to generate lists of patients who are due or overdue 
for tests or preventive care; only 20% of doctors in the United States report that 
it is easy. 14 


14 “Achieving a High-Performance Health Care System with Universal Access: What the 
United States Can Learn from Other Countries,” ACP position paper, Annals of Internal Medi- 
cine, January 2008. 
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Privacy and Security Concerns 

ACP recognizes that patients have a basic fundamental right to privacy that in- 
cludes the information contained in their own medical records — whether in elec- 
tronic or paper form. ACP has long recognized the need for appropriate safeguards 
to protect the privacy and security of patient data. Trust and respect are the corner- 
stones of the patient-physician relationship and are key to quality health care. Pa- 
tients who trust their physician are more like to fully participate in their treatment 
and comply with their care plan. 

We strongly believe that physicians — already governed by strict ethical codes of 
conduct, state professional disciplinary codes, and the Hippocratic oath — have a 
duty and responsibility to protect patient privacy. Patients need to be treated in an 
environment in which they feel comfortable disclosing sensitive and confidential 
health information to a physician they can trust. Otherwise, there may be a chilling 
effect for patients to fully disclose the most sensitive of information (conditions or 
symptoms), thereby reducing the effectiveness and timeliness of treatment, or, they 
may avoid seeking care altogether for fear of the negative consequences that could 
result from disclosure. While physicians must have access to clinically relevant in- 
formation to safely and effectively treat patients, patients must have assurances 
that adequate firewalls against unauthorized individuals gaining access to sensitive 
data are in place. Congress must ensure these safeguards are present. 

Conclusion 

The barriers to HIT adoption in physician practices can best be overcome by 
building financial incentives into Medicare and other programs. Supporting small 
practices with their initial acquisition costs and including an add-on payment for 
services documented and facilitate by an EHR will provide an infusion of funding 
that small practices need to invest in and maintain HIT. It also sends a signal that 
the Federal Government is committed to facilitating this goal. Financial incentives 
to facilitate the promising PCMH delivery model provide a mechanism to further 
HIT adoption and use in the context of an improved delivery system that further 
achieves these goals. PCMH practice recognition that is inherent in the model pro- 
vides assurance that the practice has acquired and uses HIT in an optimal manner. 
Collecting, analyzing, using, and reporting how care compares to vetted measures 
of clinical quality is also inherent in the PCMH model. 

ACP is pleased that the House Committee on Ways and Means Health Sub- 
committee on Health is examining the issues pertaining to HIT option and use. We 
strongly believe Congress has a very important role in promoting HIT adoption and 
providing the necessary initial and ongoing funding mechanisms to assist small phy- 
sician practices. The benefits of full-scale adoption of interoperable HIT will be sig- 
nificant, leading to a higher standard of quality in the health care system. Unfortu- 
nately, without adequate financial incentives, small physician practices will be left 
behind the technological curve and their patients with them. 


Chairman STARK. Thank you, Doctor. 

Ms. McGraw. 

STATEMENT OF DEVEN MCGRAW, DIRECTOR, HEALTH PRI- 
VACY PROJECT, CENTER FOR DEMOCRACY AND TECH- 
NOLOGY 

Ms. MCGRAW. Thank you, Chairman Stark, Ranking Member 
Camp, and the members of the Subcommittee. Deven McGraw, di- 
rector of the health privacy project at the Center for Democracy 
and Technology, CDT. 

CDT is a non-profit public interest organization with more than 
15 years of expertise on Internet and information privacy issues. 
The health privacy project, which was once an independent organi- 
zation, has more than a decade of experience in advocating for 
health privacy protections — again, for health information. The two 
organizations merged just this year, to combine the expertise which 



64 


is particularly timely, given the focus now on electronic and Inter- 
net-based records. 

CDT supports — CDT absolutely supports — efforts to expand the 
adoption of health information technology and health information 
exchange. Too often I think privacy advocates get labeled as trying 
to place obstacles to getting health IT in place. In fact, the opposite 
is true. We think that privacy and security protections are enablers 
to health IT. We believe that, in fact, those solutions, as Peter 
Orszag referred to, are actually obtainable in this congress and in 
subsequent congresses. 

We need to do this, because people do want electronic health 
records. But surveys show that, time after time, about two-thirds 
are concerned about the privacy and security of health information. 
Technology actually enhances our ability to keep records private 
and secure. At the same time, it also magnifies the risks. You only 
have to think about the risks of a box of records being left open 
on a table, versus a laptop with thousands of records being stolen 
out of the trunk of someone’s car. 

So, to really build public trust in these systems, we need a com- 
prehensive privacy and security framework that is based on fair in- 
formation practices, which is typically what we look to in devel- 
oping policies to protect personal information in a whole range of 
contexts. The good news is that we don’t have to start from scratch. 

First of all, we have the HIPAA privacy and security rules, which 
are based on fair information practices, and provide us with a foun- 
dation of protections that govern the use of information by health 
care organizations. We can build on this foundation, filling in the 
gaps to create, again, this comprehensive policy framework. 

There is also the common framework developed by the Markle 
Foundation’s multi-stakeholder Connecting for Health Initiative. 
So, we have lots that we can draw on. 

So, we are really calling on Congress to think big, and have a 
comprehensive vision on privacy and security. But we know this is 
a complex topic. So, in order to get it right and still facilitate the 
flow of information that is necessary to improve health care, you 
really need to think about this, take some incremental steps. So, 
think big, act incrementally, and we’re happy to work with you all 
along the way. 

So, in our written testimony, we have actually suggested a num- 
ber of areas that Congress might think about, in terms of filling 
these gaps in HIPAA, and looking at the new players in the envi- 
ronment. When I talk about new players, I am focusing in par- 
ticular on personal health records, PHRs, that are being offered by 
employers and Internet companies. They are not covered by 
HIPAA. 

But we don’t want you to address this policy vacuum by taking 
HIPAA and having it cover these entities. We don’t think that’s the 
right approach. Instead, we recommend tasking HHS and the Fed- 
eral Trade Commission, which has lots of experience in regulating 
Internet-based companies, to jointly come up with recommenda- 
tions to protect privacy and security of information in personal 
health records. 

HIPAA was really designed for health care system entities. Un- 
derstanding health care system needs for information to flow, that 
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doesn’t fit very well, in terms of a regulatory framework when 
you’re talking about entities that have a completely different busi- 
ness model, and where the revenue basis is likely to be based on 
advertising and commercial use. 

Again, we don’t have to start from scratch here, with respect to 
PH.R.s. This is another place where the Markle Connecting for 
Health Initiative has come up with a common framework. 

Enforcement is another area that we hope that Congress will pay 
attention to. As is pretty common knowledge now, I think, the HHS 
office of civil rights has not imposed a single civil monetary penalty 
for violations of HIPAA. To our knowledge, the Justice Department 
has only prosecuted a handful of criminal violations. We make rec- 
ommendations in our written testimony for some tweaks in the 
HIPAA statute that will make it easier for the Secretary to follow 
Congress’s intent to make sure that penalties are imposed in cases 
of the most egregious HIPAA violations: knowing violations and 
violations of willful neglect. 

But we also think that a significant shortfall in HIPAA is the ab- 
sence of any way for the consumer whose privacy is violated to pur- 
sue meaningful recourse and be made whole. So, we do encourage 
Congress to look at creating a private right of action, not for every 
HIPAA violation, but at least for the most egregious types. The 
government can pursue these penalties today, but they don’t go to 
the individual who is actually — if they are harmed — are really left 
holding the bag. 

Again, there are workable ways to do this. It won’t be easy. We 
are happy to work with you to find that way. But we think it’s im- 
portant to begin developing a way to ensure that covered entities 
are accountable to consumers for the most egregious violations of 
their privacy. Thank you. 

[The prepared statement of Ms. McGraw follows:] 

Prepared Statement of Deven McGraw, Director, Health 
Privacy Project, Center for Democracy and Technology 

Chairman Stark, Ranking Member Camp, and members of the Subcommittee, 
thank you for holding this hearing on promoting the adoption and use of health in- 
formation technology and for the opportunity to testify today. 

CDT is a non-profit public interest organization founded in 1994 to promote demo- 
cratic values and individual liberties for the digital age. CDT works to keep the 
Internet open, innovative and free by developing practical, real-world solutions that 
enhance free expression, privacy, universal access and democratic participation. The 
Health Privacy Project, which has more than a decade of experience in advocating 
for the privacy and security of health information, was merged into CDT earlier this 
year to take advantage of CDT’s long history of expertise on Internet and informa- 
tion privacy issues and to come up with workable solutions to better protect the pri- 
vacy and security of health information on-line and build consumer trust in e-health 
systems. 

CDT recently released a comprehensive paper calling on Congress to enact — and 
all stakeholders to adopt — a comprehensive privacy and security framework to cover 
electronic health information. Some of the points raised in that paper are high- 
lighted in this testimony today, but I also request that the full copy, which is at- 
tached and can be found at www.cdt.org/healthprivacy/20080514Hpframe.pdf, be en- 
tered into the hearing record. 

Privacy and Security Protections are Critical to Health IT 

Health information technology (health IT) and electronic health information ex- 
change can help improve health care quality and efficiency, while also empowering 
consumers to play a greater role in their own care. Survey data shows that Ameri- 
cans are well aware of both the benefits and the risks of health IT. A large majority 
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of the public wants electronic access to their personal health information — both for 
themselves and for their health care providers — because they believe such access is 
likely to increase their quality of care. At the same time, people have significant 
concerns about the privacy of their medical records. In a national survey conducted 
in 2005, 67% of respondents were “somewhat” or “very concerned” about the privacy 
of their personal medical records. 1 In a 2006 survey, when Americans were asked 
about the benefits of and concerns about online health information: 

• 80% said they are very concerned about identity theft or fraud; 

• 77% reported being very concerned about their medical information being 
used for marketing purposes; 

• 56% were concerned about employers having access to their health informa- 
tion; and 

• 55% were concerned about insurers gaining access to this information. 2 

Health IT has a greater capacity to protect sensitive personal health information 
than is the case now with paper records. Digital technologies, including strong user 
authentication and audit trails, can be employed to limit and track access to elec- 
tronic health information automatically. Electronic health information networks can 
be designed to facilitate data sharing for appropriate purposes without needing to 
create large, centralized databases that can be vulnerable to security breaches. 
Encryption can help ensure that sensitive data is not accessed when a system has 
been breached. Privacy and security policies and practices are not 100% 
tamperproof, but the virtual locks and enforcement tools made possible by tech- 
nology can make it more difficult for bad actors to access health information and 
help ensure that, when there is abuse, that the perpetrators will be detected and 
punished. 3 

At the same time, the computerization of personal health information — 3 A in the 
absence of strong privacy and security safeguards — 3 A magnifies the risk to privacy. 
As the recent spate of large-scale privacy and security breaches demonstrates, seri- 
ous vulnerabilities exist now. Tens of thousands of health records can be accessed 
or disclosed through a single breach. Recent headlines about the theft of an NIH 
laptop loaded with identifiable information about clinical research subjects under- 
score these concerns, and this is just one of numerous examples. The cumulative ef- 
fect of these reports of data breaches and inappropriate access to medical records, 
coupled with a lack of enforcement of existing privacy rules by federal authorities, 
deepens consumer distrust in the ability of electronic health information systems to 
provide adequate privacy and security protections. 4 

With rare exception, national efforts to advance greater use of health IT have not 
adequately or appropriately addressed the privacy and security issues raised by the 
movement to electronic health records. While some persist in positioning privacy as 
an obstacle to achieving the advances that greater use of health IT can bring, it is 
clear that the opposite is true: enhanced privacy and security built into health IT 
systems will bolster consumer trust and confidence and spur more rapid adoption 
of health IT and realization of its potential benefits. 

Protecting privacy is important not just to avoid harm, but because good health 
care depends on accurate and reliable information. 5 Without appropriate protections 
for privacy and security in the healthcare system, patients will engage in “privacy- 
protective” behaviors to avoid having their personal health information used inap- 
propriately. 6 According to a recent poll, one in six adults (17%) — representing 38 
million persons — say they withhold information from their health providers due to 
worries about how the medical data might be disclosed. 7 Persons who report that 
they are in fair or poor health and racial and ethnic minorities report even higher 


1 National Consumer Health Privacy Survey 2005, California Healthcare Foundation (Novem- 
ber 2005) (2005 National Consumer Survey). 

2 Study by Lake Research Partners and American Viewpoint, conducted by the Markle Foun- 
dation (November 2006) (2006 Markle Foundation Survey). 

3 See For The Record: Protecting Electronic Health Information, Committee on Maintaining 
Privacy and Security in Health Care Applications of the National Information Infrastructure, 
Computer Science and Telecommunications Board, National Research Council (National Acad- 
emy Press, Washington, DC 1997) for a discussion of the inability of systems to be 100% 
tamperproof. 

4 See http://www.cdt.org/healthprivacy/20080311stories.pdf for stories of health privacy 
breaches and inappropriate uses of personal health information. 

5 See Janlori Goldman, “Protecting Privacy to Improve Health Care,” Health Affairs (Nov-Dec, 
1998) (Protecting Privacy); Promoting Health/Protecting Privacy: A Primer, California 
Healthcare Foundation and Consumers Union (January 1999), http://www.chcf.org/topics/ 
view.cfm?itemID=1 2502 (Promoting Health/Protecting Privacy). 

6 Protecting Privacy; Promoting Health/Protecting Privacy; 2005 National Consumer Survey. 

7 Harris Interactive Poll #27, March 2007. 
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levels of concern about the privacy of their personal medical records and are more 
likely than average to practice privacy-protective behaviors . 8 

The consequences of this climate of fear are significant — for the individual, for the 
medical community, and for public health: 

• The quality of care these patients receive may suffer; 

• Their health care providers’ ability to diagnose and treat them accurately 
may be impaired; 

• The cost of care escalates as conditions are treated at a more advanced stage 
and in some cases may spread to others; and 

• Research, public health, and quality initiatives may be undermined, as the 
data in patient medical records is incomplete or inaccurate . 9 

It is often difficult or impossible to establish effective privacy protections retro- 
actively, and restoring public trust that has been significantly undermined is much 
more difficult than building it at the start. Now — in the early stages of health IT 
adoption is the critical window for addressing privacy. 

We Need a Comprehensive Privacy and Security Framework That Will 

Build Public Trust, Advance Health IT 

To build public trust in health IT, we need a comprehensive privacy and security 
framework that sets clear parameters for access, use and disclosure of personal 
health information for all entities engaged in e-health. In developing this com- 
prehensive framework, policymakers, regulators, and developers of HIT systems 
need not start from scratch. A framework for HIT and health information exchange 
already exists, in the form of the generally accepted “fair information practices” 
(“FIPS”) that have been used to shape policies governing uses of personal informa- 
tion in a variety of contexts — most notably the privacy regulations enacted pursuant 
to the Health Insurance Portability and Accountability Act (HIPAA), which estab- 
lished the first federal health privacy framework . 10 While there is no single formula- 
tion of the “FIPs,” the Common Framework developed by the Markle Foundation’s 
multi-stakeholder Connecting for Health initiative, would: 

• Implement core privacy principles; 

• Adopt trusted network design characteristics; and 

• Establish oversight and accountability mechanisms . 11 

In particular, the core privacy principles of the Connecting for Health Common 
Framework set forth a comprehensive roadmap for protecting the privacy and secu- 
rity of personal health information while still allowing information to be accessed 
and disclosed for legitimate purposes. Those core privacy principles are: 

• Openness and Transparency: There should be a general policy of openness 
about developments, practices, and policies with respect to personal data. In- 
dividuals should be able to know what information exists about them, the 
purpose of its use, who can access and use it, and where it resides. 

• Purpose Specification and Minimization: The purposes for which per- 
sonal data is collected should be specified at the time of collection, and the 
subsequent use should be limited to those purposes or others that are speci- 
fied on each occasion of change of purpose. 

• Collection Limitation: Personal health information should only be collected 
for specified purposes, should be obtained by lawful and fair means and, 
where possible, with the knowledge or consent of the data subject. 

• Use Limitation: Personal data should not be disclosed, made available, or 
otherwise used for purposes other than those specified. 

• Individual Participation and Control: 

• Individuals should control access to their personal health information: 

• Individuals should be able to obtain from each entity that controls personal 
health data, information about whether or not the entity has data relating 
to them. 

• Individuals should have the right to: 


8 2005 National Consumer Survey. 

9 Id. 

10 Other potential sources for policy recommendations include the GAO, the National Center 
for Vital Health Statistics and the National Governor’s Association State Alliance for eHealth. 

11 See www.connectingforhealth.org for a more detailed description of the Common Frame- 
work. 
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• Have personal data relating to them communicated within a reasonable time 
(at an affordable change, if any), and in a form that is readily understand- 
able. 

• Be given reasons if a request (as described above) is denied, and to be able 
to challenge such a denial. 

• Challenge data relating to them and have it rectified, completed, or amended. 

• Data Integrity and Quality: All personal data collected should be relevant 
to the purposes for which they are to be used and should be accurate, com- 
plete and current. 

• Security Safeguards and Controls: Personal data should be protected by 
reasonable security safeguards against such risks as loss, unauthorized ac- 
cess, destruction, use, modification or disclosure. 

• Accountability and Oversight: Entities in control of personal health data 
must be held accountable for implementing these information practices. 

• Remedies: Legal and financial remedies must exist to address any security 
breaches or privacy violations. 

The HIPAA privacy and security regulations include provisions that address each 
of these categories — but, as discussed in more detail below, the rules are insufficient 
to cover the new and rapidly evolving e-health environment. To build consumer 
trust in e-health systems and ensure that health IT and electronic health informa- 
tion exchange move forward with sufficient protections for privacy and security, 
Congress should consider: strengthening HIPAA for records kept by traditional 
health system participants; filling gaps in HIPAA’s coverage where appropriate; and 
establishing additional legal protections to reach new actors in the e-health environ- 
ment and address the increased migration of personal health information out of the 
traditional medical system. 

Strengthening HIPAA Privacy and Security Rules to Meet New Challenges 

The HIPAA privacy and security regulations that took effect in 2003 reflect ele- 
ments of a comprehensive framework and provide important privacy protections gov- 
erning access, use and disclosure of personally identifiable health information by 
some entities in the health care system. The HIPAA Privacy Rule was a landmark 
in privacy protection, but as noted above, the regulation does not adequately cover 
the new e-health environment. For example: 

• State and regional health information organizations or health information ex- 
changes (also known as RHIOs or HIEs), which may aggregate and facilitate 
exchange of personal health information, are often not covered by HIPAA pri- 
vacy and security regulations. Personal health records and other consumer ac- 
cess services now being created by third parties, including companies such as 
Google and Microsoft, as well as by employers usually fall outside of the 
HIPAA rules. 

• Personal health data is migrating onto the Internet through an exploding 
array of health information sites, online support groups, and other on-line 
health tools, regulated only through enforcement by the Federal Trade Com- 
mission (FTC) of the general prohibition against unfair and deceptive trade 
practices, such as a failure to follow promised privacy policies. 

• HIPAA has never required that patients receive notice when their personal 
heath information is inappropriately accessed or disclosed. 

• While the Privacy Rule includes criteria for de-identifying data, new tech- 
nologies are making it much easier to re-identify once de-identified health in- 
formation and to combine it with personal information in other databases, 
making it more likely that sensitive health information will be available to 
unauthorized recipients for uses that have nothing to do with treatment or 
payment. 

• The HIPAA rules have never been adequately enforced. The Office for Civil 
Rights (OCR) in the U.S. Department of Health and Human Services (HHS), 
charged with enforcing HIPAA, has not levied a single penalty against a 
HIPAA-covered entity in the nearly five years since the rules were imple- 
mented, even though that office has found numerous violations of the rules. 12 

Historically, states have filled the gaps in federal health privacy laws by enacting 
legislation that provides stronger privacy and security protections for sensitive data, 
such as mental health and genetic information. The states continue to have an im- 


12 “Effectiveness of medical privacy law is questioned,” Richard Alonso-Zaldivar, Los Angeles 
Times (April 9, 2008) http://www.latimes.com/business/la-na-privacy9apr09, 0,5722394. story. 
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portant role to play, but relying on the states to fill deficiencies in HIPAA’s Privacy 
Rule — or to regulate entities outside of the traditional healthcare sphere — does not 
provide a comprehensive, baseline solution that gives all Americans adequate pri- 
vacy and security protections, and does not offer all the entities in the e-health 
space a predictable and consistent policy environment. 

Although it is desirable for Congress to enact legislation that fills some of the 
gaps in HIPAA and to enact a general privacy and security framework to govern 
health IT, we caution against a “one-size-fits all” approach that treats all actors that 
hold personal health information the same. The complexity and diversity of entities 
connected through health information exchange, and their very different roles and 
different relationships to consumers, will often require precisely tailored policy solu- 
tions that are context and role-based and flexible enough to both encourage and re- 
spond to innovation. For example, it makes little sense to have the same set of rules 
for “personal health records,” which are often created by and controlled by patients 
and held by third party data stewards outside the healthcare system, and for “elec- 
tronic health records,” which are created and controlled by health care providers for 
purposes of treatment and care management. To take another example, rules for use 
of personal health information for treatment need to be quite different than rules 
for marketing or other secondary uses. Rules regarding use of health information 
for research need to be separately considered as well. Therefore, a second major 
challenge for Congress is to decide what can be legislated and what must be dele- 
gated to agency rulemaking — and what areas are best left to be developed and en- 
forced through industry best practices. 

Below we discuss in detail two critical areas that we do believe need attention 
from Congress: establishing privacy protections for personal health records offered 
by entities not currently covered by HIPAA and strengthening HIPAA enforcement. 
But CDT also recommends Congress address the following, either through express 
legislation language or by tasking HHS to modify the HIPAA privacy and security 
rules (or a combination of both approaches): 

• Clarify how the new entities that facilitate the electronic exchange of personal 
health information — including HIEs (Health Information Exchanges), RHIOs 
(Regional Health Information Organizations), and E-Prescribing Gateways — 
are covered by HIPAA (for example, by making them HIPAA covered entities 
or requiring them to have business associate agreements with the entities 
that exchange health information through them). 

• Establish a federal right for patients to be notified in the event of a breach 
of identifiable health information. 

• Tighten the definition of “marketing” in the HIPAA privacy rules to make 
clear that covered entities cannot use a patient’s protected health information 
to send a communication recommending a product or service without that pa- 
tient’s prior authorization. 

• Make clear that when entities use electronic medical records, their patients 
have the right to receive an electronic copy of their health information, and 
establish a right for patients to monitor who has accessed their health infor- 
mation through audit trails. 

• Ensure that covered entities holding protected health information access, use, 
and disclose only the minimum necessary amount of information when engag- 
ing in activities related to payment and health care operations 13 and require 
entities to use information stripped of common patient identifiers when it is 
possible to do so and still accomplish the legitimate purpose for which the in- 
formation was accessed . 14 

• Explore whether the current HIPAA de-identification standard — now five 
years old — needs to be updated given the increased public availability of data 
on-line and the possible greater potential for re-identification of de-identified 
data. 

Establishing Privacy Protections for Personal Health Records 

Personal health records and other similar consumer access services and tools now 
being created by Internet companies such as Google and Microsoft, as well as by 
employers, will not be covered by the HIPAA regulations unless they are being of- 
fered to consumers by covered entities. In this unregulated arena, consumer privacy 
will be protected only by the PHR offeror’s privacy and security policies (and poten- 


13 See 45 C.F.R. 164.501 for a definition of “health care operations.” 

14 For example, HIPAA rules provide for the use of a limited data set — information stripped 
of certain patient identifiers — for certain purposes, but its use is neither required nor expressly 
encouraged. See 45 C.F.R. 164.514(e). 
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tially under certain state laws that apply to uses and disclosures of certain types 
of health information), and if these policies are violated, the Federal Trade Commis- 
sion (FTC) may bring an action against a company for failure to abide by its privacy 
policies. The policies of PHR vendors range from very good to seriously deficient. 15 
The absence of any clear limits on how these entities can access, use and disclose 
information is alarming — and has motivated some to suggest extending the HIPAA 
Privacy Rule to cover PHRs. But we believe that the Privacy Rule, which was de- 
signed to set the parameters for use of information by traditional health care enti- 
ties, would not provide adequate protection for PHRs and may do more harm than 
good in its current scope. Further, it may not be appropriate for HHS, which has 
no experience regulating entities outside of the health care arena, to take the lead 
in enforcing consumer rights and protections with respect to PHRs. 

We believe tasking HHS and FTC with jointly developing recommendations for 
privacy and security requirements for PHRs is the right approach for ultimately es- 
tablishing comprehensive privacy and security protections for consumers using these 
new health tools. For PHRs offered by entities that are not part of the traditional 
health care system, it is critical that regulators understand the business model be- 
hind these products, which will largely rely on advertising revenue and partnerships 
with third-party suppliers of health-related products and services. Relying solely on 
consumer authorization for use of information shifts the burden of protecting pri- 
vacy solely to the consumer and puts the bulk of the bargaining power on the side 
of the entity offering the PHR. For consumers to truly trust PHRs — and for these 
tools to flourish as effective mechanisms for engaging more consumers in their 
health care — clear rules are needed regarding marketing and commercial uses that 
will better protect consumers. 

Congress Should Also Consider Strengthening HIPAA Enforcement 

When Congress enacted HIPAA in 1996, it included civil and criminal penalties 
for failure to comply with the statute — and these penalties applied to the subse- 
quent privacy and security rules implemented years later. Unfortunately, the 
HIPAA rules have never been adequately enforced. As noted above, HHS has not 
levied a single penalty against a HIPAA-covered entity in the nearly five years since 
the rules were implemented. 16 The Justice Department has levied some penalties 
under the criminal provisions of the statute — but a 2005 opinion from DOJ’s Office 
of Legal Counsel (OLC) expressly limits the application of the criminal provisions 
to covered entities, forcing prosecutors to turn to other laws in order to criminally 
prosecute certain employees of covered entities who have criminally accessed, used 
or disclosed a patient’s protected health information. 17 

A lax enforcement environment sends a message to entities that access, use and 
disclose protected health information that they need not devote significant resources 
to compliance with the rules. Without strong enforcement, even the strongest pri- 
vacy and security protections are but an empty promise for consumers. Further, 
even under the existing enforcement regime, there is no ability for consumers whose 
information is accessed or disclosed in violation of HIPAA to seek redress or be 
made whole. 

Below are a number of incremental steps that Congress can take this year to im- 
prove enforcement of HIPAA. 

Accountability for Business Associates 

Under current rules, business associates who access, use and disclose protected 
health information on behalf of covered entities are accountable for complying with 
HIPAA privacy and security regulations only through their contracts with covered 
entities. If the covered entity does not take action to enforce the contract, there is 
no other mechanism for ensuring that the business associate complies with the ap- 
plicable rules. Further, HHS can only hold the covered entity responsible for the ac- 


15 The HHS Office of the National Coordinator commissioned a study in early 2007 of the poli- 
cies of over 30 PHR vendors and found that none covered all of the typical criteria found in 
privacy policy. For example, only two policies described what would happen to the data if the 
vendor were sold or went out of business, and only one had a policy with respect to accounts 
closed down by the consumer. 

16 Just last week, HHS announced that Seattle-based Providence Health & Services agreed to 
pay $100,000 as part of a settlement of multiple violations of the HIPAA regulations. But the 
press release from HHS made clear that this amount was not a civil monetary penalty, http:// 
www.hhs.gov/news/press/2008pres/07/20080717a.html. 

17 See http://www.americanprogress.org/issues/2005/06/b743281.html for more information on 
the OLC memo and the consequences. 
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tions of business associates if the entity knew of a “pattern of activity or practice 
of the business associate that constituted a material breach or violation” of its 
agreement with the covered entity, and the covered entity doesn’t take action to 
cure the breach or terminate the contract. 18 Of interest, if the covered entity decides 
that terminating the contract is “not feasible,” the covered entity is required to re- 
port the problem to the Secretary. 19 But the regulations do not give the Secretary 
any further authority to enforce HIPAA against the business associate or hold the 
covered entity responsible for the violation. Congress should take action to ensure 
that business associates can be held legally accountable for complying with HIPAA 
regulations. 

Strengthening the Statutory Provisions Authorizing Civil and Criminal Penalties 

Penalties for Criminal Violations. As noted above, the HIPAA statute provides for 
criminal penalties for intentional violations; but a DOJ Office of Legal Counsel 
Memo expressly limits the application of these provisions to covered entities. Accord- 
ing to this memo, DOJ cannot prosecute employees of covered entities or their busi- 
ness associates for intentional violations of HIPAA unless these persons are carrying 
out a specific policy or business practice endorsed by the covered entity. Congress 
should make it clear that penalties can be assessed against covered entities, busi- 
ness associates, and their employees for violations of HIPAA. 

Civil Monetary Penalties — Part I. The statute prohibits the Secretary of HHS from 
imposing civil monetary penalties if the HIPAA violation is “an offense punishable” 
under the criminal provisions of the statute. 20 A reasonable interpretation of this 
provision is that if a HIPAA complaint indicates a possible criminal violation, the 
Secretary of HHS cannot launch a civil investigation or pursue civil monetary pen- 
alties, even if DOJ decides not to prosecute the case. To avoid having the most egre- 
gious HIPAA violations go unpunished, Congress should act to give the Secretary 
clear authority to investigate and pursue civil monetary penalties unless DOJ de- 
cides to pursue criminal penalties. 

Civil Monetary Penalties — Part II. The civil penalty provisions of the statute envi- 
sion three types of HIPAA violations: those that the entity was not aware of (or 
could not have been aware of exercising reasonable diligence); those due to reason- 
able cause; and those due to willful neglect. 21 The statute also prohibits the Sec- 
retary from imposing civil monetary penalties in cases of lack of knowledge or due 
to reasonable cause, unless the entity is unable to correct the violation within a 30- 
day time period (with discretion to extend this time period). 22 The statute also gives 
the Secretary authority to provide compliance assistance to help the covered entity 
correct a violation due to reasonable cause and to waive or reduce a penalty in cases 
of reasonable cause if the penalty would be excessive relative to the compliance fail- 
ure involved. 23 The statute requires that the Secretary impose civil monetary pen- 
alties for HIPAA violations; 24 the statute does not give the Secretary discretion to 
give a covered entity a chance to correct the violation or the authority to waive or 
reduce penalties in cases of willful neglect. The HIPAA enforcement regulations, 
however, require the Secretary to first try to informally resolve all HIPAA com- 
plaints — which means there is never an investigation into whether or not the viola- 
tion rises to the level of willful neglect (and thus should be subject to civil monetary 
penalties). Congress should act to clarify that the Secretary must investigate all 
complaints for which a preliminary inquiry into the facts indicates possible willful 
neglect and pursue civil monetary penalties in willful neglect cases. 

Establishing Penalties for Re-identification of De -identified Data 

Health information that is de-identified is not covered by the protections of 
HIPAA. Thus, covered entities can provide de-identified data to other persons or en- 
tities without regard to the requirements regarding access, use and disclosure in the 
HIPAA regulations, and these entities can use this data as they wish, subject only 
to the terms of any applicable contractual requirements (or any state laws that 


18 45 C.F.R. 164.504(e)(ii). 

19 Id. 

20 Section 1176(b)(1) of the Social Security Act. 

21 See Sections 1176(b)(2) — (3) of the Social Security Act. 

22 Id. 

23 Sections 1176(b)(3) — (4) of the Social Security Act. 

24 See Section 1176(a) of the Social Security Act (“. . . The Secretary shall impose on any per- 
son who violates a provision of this part a penalty of not more than $100 for each such violation, 
except that the total amount imposed on the person for all violations of an identical requirement 
or prohibition during a calendar year may not exceed $25,000”). 
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might apply). If one of these persons or entities then re-identifies this data — for ex- 
ample, by using information available in a public database — that re-identified infor- 
mation would not be subject to HIPAA regulations unless the person or entity hold- 
ing the data was a covered entity. Earlier in this testimony we suggest examining 
the current HIPAA de-identification standard to ensure that it continues to provide 
robust protection for patient-identifiable data. But Congress could also protect indi- 
vidual privacy by enacting prohibitions (and penalties for) the unauthorized re-iden- 
tification of de-identified data. 

Other Ways to Improve Accountability under HIPAA 

A significant shortfall in HIPAA is the absence of any way for the consumer 
whose health information privacy has been violated to pursue meaningful recourse 
and be made whole. CDT believes that a private right of action should be part of 
any enforcement scheme. We recognize that providing a private right of action to 
pursue every HIPAA complaint no matter how trivial would be inappropriate and 
disruptive, but Congress should further consider giving consumers some right to pri- 
vately pursue recourse where there are intentional violations of the law, or in cir- 
cumstances of willful neglect. As noted above, the HIPAA statute already provides 
for criminal and civil monetary penalties in such cases — but these penalties do not 
currently go to the consumers whose privacy was violated, and as structured may 
not be sufficient (at least with respect to civil penalties) to provide meaningful re- 
course for individuals. 

Structuring an effective private right of action will take careful thought and con- 
sideration. Given the dwindling number of legislative days left in the year and polit- 
ical circumstances, we recognize that it is unlikely we can pursue implementing 
such a right this year. But we urge Congress to hold hearings on this issue to begin 
to develop a workable way to ensure that entities covered by HIPAA are directly 
accountable to consumers for the most egregious violations of their privacy. In the 
meantime, the recommendations we set forth above are ones that can be put into 
legislation this year and if implemented will greatly improve HIPAA enforcement. 

Congress should also consider authorizing State Attorneys General to also enforce 
HIPAA. The HHS Office of Civil Rights is significantly under-resourced, and ex- 
pressly authorizing state authorities to enforce HIPAA puts more hands on the en- 
forcement deck. Currently, only those State Attorneys General who expressly have 
the authority to enforce federal law in their state authorizing statutes are able to 
enforce the federal HIPAA provisions. State authorities are able to enforce their own 
state health privacy laws, but in only a handful of states are those laws are as com- 
prehensive as HIPAA. Congress should consult with State Attorneys General about 
providing them with express authority to enforce HIPAA and consider taking future 
action in this area (particularly if the enforcement “fixes” recommended earlier in 
this testimony are not successful in actually improving HIPAA enforcement). 

The Appropriate Role of Consumer Consent 

Recently, public debates about how best to protect the confidentiality, privacy and 
security of health information have focused almost exclusively on whether patients 
should be asked to authorize all uses of their health information. The ability of indi- 
viduals to have some control over their personal health information is important, 
and a comprehensive privacy and security framework should address patient con- 
sent . 25 A number of states have passed laws requiring patient authorization to ac- 
cess, use and disclose certain sensitive categories of health information, and federal 
law prohibits the disclosure of substance abuse treatment records without express 
patient authorization. HIPAA Privacy Rules currently prohibit the use of certain 
types of information, such as psychotherapy notes, or prohibit use of information for 
certain purposes, such as marketing, without express patient authorization, and the 
Rules provide individuals with the right to object to certain uses and disclosures 
(such as in facility directories or to family members). The Rules also allow covered 
entities to give consumers greater rights to restrict uses and disclosures of their in- 
formation. Health information systems must be structured in a way that allows 
these consents to be honored and appropriately and securely managed. 

But patient authorization is not a panacea, and as appealing as it may appear 
to be in concept, in practice reliance on consent would provide weak protection for 
consumer’s health information. If health privacy rules fail to address the range of 


25 Much more should be done to improve the way in which consent options are presented to 
consumers in the healthcare context. Internet technology can help in this regard, making it easi- 
er to present short notices, layered notices and more granular forms of consent. 
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privacy and security issues through concrete policies, and instead rely only (or sig- 
nificantly) on giving individuals the right to consent to multiple uses and disclosures 
of their personal health information, the result is likely to be a system that is less 
protective of privacy and confidentiality. 

Among other reasons, a consent-based system places most of the burden of privacy 
protection on patients at a time where they may be least able to make complicated 
decisions about use of their health data. Most don’t read the details of a consent 
form and those that do often do not understand the terms. Many wrongly assume 
that the existence of a “privacy policy” means that their personal information will 
not be shared, even when the policy and the accompanying consent form say just 
the opposite. 26 If mere patient authorization is all that is needed to share data with 
third parties, highly sensitive patient information will be disclosed to entities that 
are completely outside the scope of the HIPAA privacy regulation. If consent be- 
comes the focus of privacy protection, it is clear that patients will be exposed to un- 
regulated and potentially uncontemplated uses — and misuses — of their data. Fur- 
ther, if policymakers rely on consent by an individual for any particular use of his 
or her information as the key to privacy protection, the healthcare industry will 
have fewer incentives to design systems with stronger privacy and security protec- 
tions. 

In contrast, a comprehensive approach — which puts clear parameters around who 
can access, use and disclose a patient’s personal health information and for what 
purposes — puts the principal burden on the entities holding this information by 
placing clear enforceable limits on the collection and use of personal health informa- 
tion and backs it up with strong enforcement. 27 

Conclusion 

Thank you for the opportunity to present this testimony in support of strength- 
ening privacy and security protections for personal health information, which will 
build consumer trust and enable health IT and electronic health information ex- 
change to move forward. I would be pleased to answer any questions you may have. 

Attachment 


Comprehensive Privacy and Security: Critical for Health Information Technology 
Version 1.0 — May 2008 

In this paper, CDT calls for the adoption of a comprehensive privacy and security 
framework for protection of health data as information technology is increasingly 
used to support exchange of medical records and other health information. CDT be- 
lieves that privacy and security protections will build public trust, which is crucial 
if the benefits of health IT are to be realized. In CDT’s view, implementation of a 
comprehensive privacy and security framework will require a mix of legislative ac- 
tion, regulation and industry commitment and must take into account the com- 
plexity of the evolving health exchange environment. 

Privacy and Security Protections are Critical to Health IT 

Health information technology (health IT) and health information exchange can 
help improve health care quality and efficiency, while also empowering consumers 
to play a greater role in their own care. At the federal and state levels, policymakers 
are pushing initiatives to move the health care system more rapidly into the digital 
age. 


26 See “Stopping Spyware at the Gate: A User Study of Privacy, Notice and Spyware” (with 
Nathan Good, Rachna Dhamija, Jens Grossklags, Steven Aronovitz, David Thaw and Joseph 
Konstan), presented at the 2005 Symposium on Usable Privacy and Security (SOUPS), also in 
ACM INTERNATIONAL CONFERENCE PROCEEDING SERIES; VOL. 93, PROCEEDINGS 
OF THE 2005 SYMPOSIUM ON USABLE PRIVACY AND SECURITY, Pittsburgh, Pennsyl- 
vania (2005); 2005 National Consumer Survey; “Research Report: Consumers Fundamentally 
Misunderstand the Online Advertising Marketplace,” Joseph Turow, Deidre K. Mulligan and 
Chris Jay Hoofnagle, survey conducted by University of Pennsylvania Annenberg School for 
Communications and UC-Berkeley Law School’s Samuelson Law, Technology and Public Policy 
Clinic 2007. 

27 By contrast, a comprehensive approach puts the principal burden on the entities holding 
personal health information to protect privacy by placing clear enforceable limits on the collec- 
tion and use of personal health information and backs it up with strong enforcement. See Be- 
yond Consumer Consent: Why We Need a Comprehensive Approach to Privacy in a Networked 
World, http://www.cdt.org/healthprivacy/20080221consentbrief.pdf. 



74 


However, health IT initiatives pose heightened risks to privacy. Recent breaches 
of health information underscore that the risks are real. At the same time, there 
is widespread confusion and misinterpretation about the scope of current health pri- 
vacy laws. Some are pushing for quick “fixes” to try to address the public’s privacy 
concerns, but fully resolving these issues requires a comprehensive, thoughtful and 
flexible approach. 

While some persist in positioning privacy as an obstacle to achieving the advances 
that greater use of health IT can bring, it is clear that the opposite is true: en- 
hanced privacy and security built into health IT systems will bolster consumer trust 
and confidence and spur more rapid adoption of health IT and realization of its po- 
tential benefits. 

Survey data shows that Americans are well aware of both the benefits and the 
risks of health IT. A large majority of the public wants electronic access to their 
personal health information — both for themselves and for their health care pro- 
viders — because they believe such access is likely to increase their quality of care. 
At the same time, people have significant concerns about the privacy of their med- 
ical records. In a national survey conducted in 2005, 67% of respondents were 
“somewhat” or “very concerned” about the privacy of their personal medical 
records. 28 In a 2006 survey, when Americans were asked about the benefits of and 
concerns about online health information: 

• 80% said they are very concerned about identity theft or fraud; 

• 77% reported being very concerned about their medical information being 
used for marketing purposes; 

• 56% were concerned about employers having access to their health informa- 
tion; and 

• 53% were concerned about insurers gaining access to this information. 29 

Appropriate privacy protections must be incorporated from the outset in the de- 
sign of new health IT systems and policies. It is often difficult or impossible to es- 
tablish effective privacy protections retroactively, and restoring public trust that has 
been significantly undermined is much more difficult than building it at the start. 
Now — in the early stages of health IT adoption — is the critical window for address- 
ing privacy. 

As an Internet policy organization and privacy advocate, CDT brings a unique 
perspective to these issues, based on our experience in shaping workable privacy so- 
lutions for a networked environment. In this paper, we describe why it is necessary 
that all parties — from traditional health care entities and new developers of per- 
sonal health records, to legislators and regulators — address privacy and security in 
health IT systems. We emphasize that all stakeholders need to begin immediately 
to implement and enforce a comprehensive privacy and security framework in all 
of the various tools and processes of health IT. 

The Consequences of Failing to Act 

Protecting privacy is important not just to avoid harm, but because good health 
care depends on accurate and reliable information. 30 Without appropriate protec- 
tions for privacy and security in the healthcare system, patients will engage in “pri- 
vacy-protective” behaviors to avoid having their personal health information used 
inappropriately. 31 According to a recent poll, one in six adults (17%) — representing 
38 million persons — say they withhold information from their health providers due 
to worries about how tbe medical data might be disclosed. 32 Persons who report that 
they are in fair or poor health and racial and ethnic minorities report even higher 
levels of concern about the privacy of their personal medical records and are more 
likely than average to practice privacy-protective behaviors. 33 

People who engage in privacy-protective behaviors to shield themselves from stig- 
ma or discrimination often pay out-of-pocket for their care; ask doctors to fudge a 
diagnosis; switch doctors frequently to avoid having all of their records in one loca- 


28 National Consumer Health Privacy Survey 2005, California HealthCare Foundation (No- 
vember 2005) (2005 National Consumer Survey). 

29 Study by Lake Research Partners and American Viewpoint, conducted by the Markle Foun- 
dation (November 2006) (2006 Markle Foundation Survey). 

30 See Janlori Goldman, “Protecting Privacy To Improve Health Care,” Health Affairs (Nov- 
Dee, 1998) (Protecting Privacy); Promoting Health/Protecting Privacy: A Primer, California 
Healthcare Foundation and Consumers Union (January 1999), http://www.chcf.org/topics/ 
view. cfm?itemID= 12502 (Promoting Health/Protecting Privacy). 

31 Protecting Privacy; Promoting Health/Protecting Privacy; 2005 National Consumer Survey. 

32 Harris Interactive Poll #27, March 2007. 

33 2 005 National Consumer Survey. 
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tion; lie; or even avoid seeking care altogether. 34 The consequences are significant — 
for the individual, for the medical community, and for public health: 

• The quality of care these patients receive may suffer; 

• Their health care providers’ ability to diagnose and treat them accurately 
may be impaired; 

• The cost of care escalates as conditions are treated at a more advanced stage 
and in some cases may spread to others; and 

• Research, public health, and quality initiatives may be undermined, as the 
data in patient medical records is incomplete or inaccurate. 35 

Health IT Can Protect Privacy — But Magnifies Risks 

Health IT has a greater capacity to protect sensitive personal health information 
than is the case now with paper records. For example, it is often impossible to tell 
whether someone has inappropriately accessed a paper record. By contrast, tech- 
nologies, including strong user authentication and audit trails, can be employed to 
limit and track access to electronic health information automatically. Electronic 
health information networks can be designed to facilitate data sharing for appro- 
priate purposes without needing to create large, centralized databases of sensitive 
information that can be vulnerable to security breaches. Encryption can help ensure 
that sensitive data is not accessed when a system has been breached. Privacy and 
security policies and practices are not 100% tamperproof, but the virtual locks and 
enforcement tools made possible by technology can make it more difficult for bad 
actors to access health information and help ensure that, when there is abuse, that 
the perpetrators will be detected and punished. 36 

At the same time, the computerization of personal health information — in the ab- 
sence of strong privacy and security safeguards — magnifies the risk to privacy. As 
the recent spate of large-scale privacy and security breaches demonstrates, serious 
vulnerabilities exist now. Tens of thousands of health records can be accessed or dis- 
closed through a single breach. Recent headlines about the theft of an NIH laptop 
loaded with identifiable information about clinical research subjects, and the acci- 
dental posting of identifiable health information on the Internet by a health plan, 
underscore these concerns, and are just two of numerous examples. The cumulative 
effect of these reports of data breaches and inappropriate access to medical records, 
coupled with the lack of enforcement of existing privacy rules by federal authorities, 
deepens consumer distrust in the ability of electronic health information systems to 
provide adequate privacy and security protections. 37 

Elements of a Comprehensive Privacy and Security Framework That Will Build 

Public Trust, Advance Health IT 

A comprehensive privacy and security framework must be implemented by all 
stakeholders engaged in e-health efforts. Such a framework, as outlined by the 
Markle Foundation’s Connecting for Health, would: 

• Implement core privacy principles; 

• Adopt trusted network design characteristics; 

• Establish oversight and accountability mechanisms. 

Congress should set the framework for national policy through legislation. Ensur- 
ing and enforcing adequate protections for privacy and security also will require co- 
ordinated actions on the part of key regulatory agencies, as well as industry best 
practices. The framework should be implemented in part by strengthening the 
HIPAA Privacy Regulation for records kept by the traditional health system partici- 
pants, but also needs to address the increased migration of personal health informa- 
tion out of the traditional medical system. 

Notwithstanding the urgent need to address privacy, health information policy 
initiatives — both legislative and administrative — are moving forward without ad- 
dressing privacy and security at all, or they are taking a piecemeal approach that 


34 Protecting Privacy; 2005 National Consumer Survey; Promoting Health/Protecting Privacy. 
36 Id. 

36 See For The Record: Protecting Electronic Health Information, Committee on Maintaining 
Privacy and Security in Health Care Applications of the National Information Infrastructure, 
Computer Science and Telecommunications Board, National Research Council (National Acad- 
emy Press, Washington, DC 1997) for a discussion of the inability of systems to be 100% 
tamperproof. 

37 See http://www.cdt.org/healthprivacy/20080311stories.pdf for stories of health privacy 
breaches and inappropriate uses of personal health information. 
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too narrowly focuses on a single activity, such as e-prescribing, or on just one aspect 
of fair information practices, such as the appropriate role of patient consent. 

In developing a comprehensive framework, policymakers, regulators, and devel- 
opers of HIT systems need not start from scratch. A framework for HIT and health 
information exchange already exists, in the form of the generally accepted “fair in- 
formation practices” (“FIPS”) that have been used to shape policies governing uses 
of personal information in a variety of contexts, most notably the HIPAA Privacy 
Regulation, which established the first federal health privacy framework. 38 While 
there is no single formulation of the “FIPs,” the Common Framework developed by 
the Markle Foundation’s Connecting for Health initiative, which includes broad rep- 
resentation from across the health care industry and patient advocacy organiza- 
tions, describes the principles as follows: 

• Openness and Transparency: There should be a general policy of openness 
about developments, practices, and policies with respect to personal data. In- 
dividuals should be able to know what information exists about them, the 
purpose of its use, who can access and use it, and where it resides. 

• Purpose Specification and Minimization: The purposes for which personal 
data is collected should be specified at the time of collection, and the subse- 
quent use should be limited to those purposes or others that are specified on 
each occasion of change of purpose. 

• Collection Limitation: Personal health information should only be collected for 
specified purposes, should be obtained by lawful and fair means and, where 
possible, with the knowledge or consent of the data subject. 

• Use Limitation: Personal data should not be disclosed, made available, or oth- 
erwise used for purposes other than those specified. 

• Individual Participation and Control: 

• Individuals should control access to their personal health information: 

§ Individuals should be able to obtain from each entity that controls personal 
health data, information about whether or not the entity has data relating to 
them. 

• Individuals should have the right to: 

§Have personal data relating to them communicated within a reasonable time 
(at an affordable change, if any), and in a form that is readily understandable; 

§Be given reasons if a request (as described above) is denied, and to be able 
to challenge such a denial: 

§ Challenge data relating to them and have it rectified, completed, or amended. 

• Data Integrity and Quality: All personal data collected should be relevant 
to the purposes for which they are to be used and should be accurate, 
complete and current. 

• Security Safeguards and Controls: Personal data should be protected by 
reasonable security safeguards against such risks as loss, unauthorized 
access, destruction, use, modification or disclosure. 

• Accountability and Oversight: Entities in control of personal health data 
must be held accountable for implementing these information practices. 

• Remedies: Legal and financial remedies must exist to address any secu- 
rity breaches or privacy violations. 

The Connecting for Health Common Framework also sets forth characteristics for 
network design that can help ensure health information privacy and security. 39 
These network design characteristics facilitate health information exchange not 
through centralization of data but rather through a “network of networks.” Such a 
distributed architecture is more likely to protect information. Other key elements 
of such a system are interoperability and flexibility, which support innovation and 
create opportunities for new entrants. 

The Role of HIPAA in the New Environment 

The federal privacy and security rules that took effect in 2003 under the Health 
Insurance Portability and Accountability Act (HIPAA) reflect elements of this frame- 
work and provide important privacy protections governing access, use and disclosure 
of personally identifiable health information by some entities in the health care sys- 


38 Other potential sources for policy recommendations include the GAO, the National Center 
for Vital Health Statistics and the National Governor’s Association State Alliance for eHealth. 

39 See www.connectingforhealth.org for more details on the Common Framework. 
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tem. The HIPAA Privacy Rule was a landmark in privacy protection, but it is widely 
recognized that the regulation is insufficient to adequately cover the new and rap- 
idly evolving e-health environment. For example: 

• State and regional health information organizations or health information ex- 
changes (also known as RHIOs or HIEs), which may aggregate and facilitate 
exchange of personal health information, are often not covered by HIPAA’s 
Privacy Rule. 

• Personal health records and other consumer access services now being created 
by third parties, including companies such as Google and Microsoft, as well 
as by employers usually fall outside of the HIPAA rules. 

• Personal health data is migrating onto the Internet through an exploding 
array of health information sites, online support groups, and other on-line 
health tools, regulated only through enforcement by the Federal Trade Com- 
mission (FTC) of the general prohibition against unfair and deceptive trade 
practices, such as a failure to follow promised privacy policies. 

• While the Privacy Rule includes criteria for de-identifying data, new tech- 
nologies are making it much easier to re-identify once de-identified health in- 
formation and to combine it with personal information in other databases, 
making it more likely that sensitive health information will be available to 
unauthorized recipients for uses that have nothing to do with treatment or 
payment. 

In addition, the HIPAA rules have never been adequately enforced. The HHS Of- 
fice for Civil Rights (OCR), charged with enforcing HIPAA, has not levied a single 
penalty against a HIPAA-covered entity in the nearly five years since the rules were 
implemented, even though that office has found numerous violations of the rules . 40 

Historically, states have filled the gaps in federal health privacy laws by enacting 
legislation that provides stronger privacy and security protections for sensitive data, 
such as mental health and genetic information. The states continue to have an im- 
portant role to play, but relying on the states to fill deficiencies in HIPAA’s Privacy 
Rule — or to regulate entities outside of the traditional healthcare sphere — does not 
provide a comprehensive, baseline solution that gives all Americans adequate pri- 
vacy and security protections, and does not offer all the entities in the e-health 
space a predictable and consistent policy environment. 

National Conversations about Privacy and Security Have Been Too Focused on the 

Issue of Individual Consent 

The ability of individuals to have some control over their personal health informa- 
tion is important, and a comprehensive privacy and security framework should ad- 
dress patient consent . 41 However, consent is not a panacea. If health privacy rules 
fail to address the range of privacy and security issues through concrete policies, 
and instead rely only (or significantly) on giving individuals the right to consent to 
multiple uses and disclosures of their personal health information, the result is like- 
ly to be a system that is less protective of privacy and confidentiality. 

Among other reasons, a consent-based system places most of the burden of privacy 
protection on patients at a time where they may be least able to make complicated 
decisions about use of their health data. Most don’t read the details of a consent 
form and those that do often do not understand the terms. Many wrongly assume 
that the existence of a “privacy policy” means that their personal information will 
not be shared, even when the policy and the accompanying consent form say just 
the opposite . 42 If mere patient authorization is all that is needed to share data with 
third parties, highly sensitive patient information will be disclosed to entities that 


40 “Effectiveness of medical privacy law is questioned,” Richard Alonso-Zaldivar, Los Angeles 
Times (April 9, 2008) http://www.latimes.com/business/la-na-privacy9apr09, 0,5722394. story. 

41 Much more should be done to improve the way in which consent options are presented to 
consumers in the healthcare context. Internet technology can help in this regard, making it easi- 
er to present short notices, layered notices and more granular forms of consent. 

42 See “Stopping Spyware at the Gate: A User Study of Privacy, Notice and Spyware" (with 
Nathan Good, Rachna Dhamija, Jens Grossklags, Steven Aronovitz, David Thaw and Joseph 
Konstan), presented at the 2005 Symposium on Usable Privacy and Security (SOUPS), also in 
ACM INTERNATIONAL CONFERENCE PROCEEDING SERIES; VOL. 93, PROCEEDINGS 
OF THE 2005 SYMPOSIUM ON USABLE PRIVACY AND SECURITY, Pittsburgh, Pennsyl- 
vania (2005); 2005 National Consumer Survey; “Research Report: Consumers Fundamentally 
Misunderstand the Online Advertising Marketplace,” Joseph Turow, Deidre K. Mulligan and 
Chris Jay Hoofnagle, Survey conducted by University of Pennsylvania Annenberg School for 
Communications and UC-Berkeley Law School’s Samuelson Law, Technology and Public Policy 
Clinic 2007. 
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are completely outside the scope of the HIPAA privacy regulation. If consent be- 
comes the focus of privacy protection, it is clear that patients will be exposed to un- 
regulated and potentially uncontemplated uses — and misuses of their data. Further, 
if reliance on consent by an individual for any particular use of his or her informa- 
tion is treated by policymakers as the key to privacy protection, the healthcare in- 
dustry will have fewer incentives to design systems with stronger privacy and secu- 
rity protections. 43 

All Entities Should Adopt and Implement a Comprehensive Privacy and Security 

Framework 

Regardless of whether or not Congress takes action to address these issues, states 
and entities developing health information exchanges and other health IT initiatives 
should commit to adoption of the comprehensive privacy framework outlined here. 
Guidance for policy development for health information exchanges can be found, for 
example, in the Common Framework developed by the Markle Foundation’s Con- 
necting for Health Project. Consumer access services such as PHRs must also imple- 
ment the comprehensive framework through rigorous privacy and security protec- 
tions. 44 Such entities should make their privacy commitment explicit in a published 
privacy notice. Consumers should look for these promises and should measure them 
against the framework. Once companies make a privacy promise, they will be bound 
to it under the Federal Trade Commission Act. In addition, consumer rating services 
can compare and assess privacy practices, measuring them against the principles 
outlined here. 

Congress Should Establish a Comprehensive Health Privacy and Security Approach 

Although states and the private sector should not wait for action by Congress to 
protect privacy, CDT believes that Congress should establish national policy to en- 
sure that health information technology and electronic health information exchange 
is facilitated by strong and enforceable privacy and security protections. 

According to recent surveys: 

• 75% believe the government has a role in establishing rules to protect the pri- 
vacy and confidentiality of online health information; 

• 66% say the government has a role in establishing the rules by which busi- 
nesses and other third parties can have access to personal health information; 
and 

• 69% say the government has a role in encouraging doctors and hospitals to 
make their personal health information available over the Internet in a se- 
cure way. 45 

One of the major challenges in developing a comprehensive privacy and security 
framework is to integrate any new rules with the HIPAA privacy and security rules. 
Congress should consider both strengthening HIPAA where appropriate and estab- 
lishing additional legal protections to reach new actors in the e-health environment. 

Congress should set the general rules — the attributes that a trusted health infor- 
mation system must have — based on the Fair Information Practices discussed ear- 
lier. Further, Congress should hold a series of hearings on some of the more difficult 
issues to resolve and develop a full record that will serve as the basis for more spe- 
cific legislative action. In particular, Congress should consider: 

• The appropriate role for patient consent for different e-health activities; 

• The ability of consumers to have understandable information about where 
and how their Personal Health Information (PHI) is accessed, used, disclosed 
and stored; 

• The right of individuals to view all PHI that is collected about them and be 
able to correct or remove data that is not timely, accurate, relevant, or com- 
plete; 

• Limits on the collection, use, disclosure and retention of PHI; 

• Requirements with respect to data quality; 


43 By contrast, a comprehensive approach puts the principal burden on the entities holding 
personal health information to protect privacy by placing clear enforceable limits on the collec- 
tion and use of personal health information and backs it up with strong enforcement. See Be- 
yond Consumer Consent: Why we need a Comprehensive Approach to Privacy in a Networked 
World, http://www.cdt.org/healthprivacy/20080221consentbrief.pdf. 

44 See, e.g. the Best Practices for Employers offering PHRs http://cdt.org/healthprivacy/ 

200712 18Best Practices.pdf. 

46 2006 Markle Foundation Survey. 
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• Reasonable security safeguards given advances in affordable security tech- 
nology; 

• Use of PHI for marketing; 

• Other secondary uses (or “reuses”) of health information; 

• Responsibilities of “downstream” users of PHI; 

• Accountability for complying with rules and policies governing access, use, 
and disclosure, enforcement, and remedies for privacy violations or security 
breaches ; 46 and 

• Uses and safeguards for de-identified information. 

Congress Also Should Enact Legislation to Strengthen HIPAA For Health System 

Entities 

With respect to the access, use and disclosure of electronic health information by 
the traditional players in the health care system, there are some immediate steps 
Congress could take to fill some of the gaps in HIPAA. For example, Congress can 
take a number of actions to secure more meaningful enforcement of the HIPAA 
rules, including: 

• Strengthening Office for Civil Right’s (OCR’s) role by requiring it to conduct 
periodic audits of covered entities and their business associates to ensure 
compliance with the rules; 

• Increasing the penalties associated with failure to comply with key provisions 
of the HIPAA rules; 

• Increasing resources dedicated to HIPAA enforcement; 

• Requiring OCR to report to Congress on a regular basis on enforcement of the 
rules; and 

• Amending HIPAA to allow for enforcement of the rule by state authorities 
(such as attorneys general). 

Congress should also consider enacting legislative provisions to: 

• Establish notification requirements and penalties for data breaches; 

• Strengthen the existing HIPAA rules requiring express authorization for use 
of patient identifiable data for marketing; and 

• Require electronic health systems to provide consumers with access to their 
health information in an electronic format. 

Although it is desirable for Congress to enact legislation that fills some of the 
gaps in HIPAA and to enact a general privacy and security framework to govern 
health IT, it will be impossible for Congress to legislatively adopt comprehensive 
rules that fit all of the various actors and business models in the rapidly expanding 
and evolving e-health environment. Therefore, a second major challenge for Con- 
gress is to decide what can be legislated and what must be delegated to agency rule- 
making — and what areas are best left to be developed and enforced through indus- 
try best practices. 

Strengthening Privacy and Security Will Also Require a More Tailored Regulatory 

Approach 

While Congress should establish a strong framework for health privacy and secu- 
rity, it must avoid a “one size fits all ” approach that treats all actors that hold per- 
sonal health information the same. The complexity and diversity of entities con- 
nected through health information exchange, and their very different roles and dif- 
ferent relationships to consumers, require precisely tailored policy solutions that are 
context and role-based and flexible enough to both encourage and respond to innova- 
tion. For example, it makes little sense to have the same set of rules for “personal 
health records,” which are often created by and controlled by patients and held by 
third party data stewards outside the healthcare system, and for “electronic health 
records,” which are created and controlled by health care providers for purposes of 
treatment and care management. To take another example, rules for use of personal 
health information for treatment need to be quite different than rules for marketing 
or other secondary uses. Rules regarding use of health information for research need 
to be separately considered as well. 

Congress should not attempt to develop all of the details in legislation. Rather, 
Congress should enact legislation specifically recognizing the importance of the pri- 
vacy rights in health information across technology platforms and business models, 
setting out principles and attributes to guide one or more regulatory agencies in de- 


46 See the Common Framework, www.connectingforhealth.org. 
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veloping detailed, context-specific rules for the range of entities that collect, use and 
distribute personal health information in the new interconnected healthcare system. 
One approach would be to direct the Department of Health and Human Services to 
strengthen the HIPAA regulations that apply to traditional players in the health 
system, while also directing HHS or possibly the Federal Trade Commission to issue 
regulations to govern the handling of personal health information by new players 
who are part of the broader Internet marketplace and not part of the healthcare 
system. If more than one agency is to be involved, Congress could require them to 
work together to avoid issuing conflicting rules (as the financial services regulatory 
agencies did in developing security rules for financial information). 

Tasking HHS and/or the FTC with the responsibility for developing detailed regu- 
lations allows for: 

• A more tailored, flexible approach that will ensure comprehensive privacy and 
security protections in a myriad of different e-health environments, and 

• More regular, active monitoring of developments in the marketplace and a 
more rapid response to newly emerging privacy and security issues. 

Congress should maintain strong oversight over the regulatory process by: 

• Requiring regulations to be developed within a particular timeframe; 

• Requiring satisfactory completion of the rulemaking before federal HIT grants 
can be made; 

• Mandating reporting by the agencies on implementation and enforcement; 
and 

• Vigorous oversight and reporting on implementation and enforcement. 
Conclusion 

To establish greater public trust in HIT and health information exchange systems, 
and thereby facilitate adoption of these new technologies, a comprehensive privacy 
and security framework must be in place. From traditional health entities to new 
developers of consumer-oriented health IT products to policymakers, all have an im- 
portant role to play in ensuring a comprehensive privacy and security framework 
for the e-health environment. Congress should set the framework for privacy and 
security by strengthening enforcement of existing law and ensuring that all holders 
of personal health information are subject to a comprehensive privacy framework. 
Congress can also take immediate steps to strengthen existing privacy rules, for ex- 
ample, empowering consumers to play a greater role in their healthcare by man- 
dating electronic access to their health records. Given the broad array of entities in 
the e-health arena, the technological changes in the marketplace today, and the 
prospects for rapid innovation, much of the details of that framework should be 
worked out through the regulatory process. The challenge for policymakers is to find 
the right mix of statutory direction, regulatory implementation, and industry best 
practices to build trust in e-health systems and enable the widespread adoption of 
health IT. 

For more information please contact: Deven McGraw, Director, CDT’s Health Pri- 
vacy Project, 202-637-9800 http://www.cdt.org. 


Chairman STARK. Thank you. 

Dr. King. 

STATEMENT OF MATTHEW KING, M.D., CHIEF MEDICAL 
OFFICER, CLINICA ADELANTE, INC., SURPRISE, ARIZONA 

Dr. KING. Yes. Thank you, Chairman Stark and Ranking — Mr. 
Camp, and the rest of the Subcommittee Members. I am the chief 
medical officer of Clinica Adelante, which is a medium-sized com- 
munity health center, which is located in Phoenix, Arizona. We 
have seven sites and a mobile clinic that serves remote areas of 
Maricopa County. Our clinic has 26 providers. We have 32,000 pa- 
tients and 90,000 encounters a year. About half of our patients are 
uninsured. We wanted an electronic health record to help us in im- 
proving the quality of care, particularly around areas of chronic 
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disease management, and also to help us with preventative care 
management. 

I think the reason why I am here is because we chose an open 
source electronic health solution that was based on the Veterans 
Administration VISTA system. It is called World Vista EHR, and 
it is CCH IT-certified. We chose it for two reasons. The first reason 
was because we believe that open source is a very viable paradigm 
to be used in health information technology. The second reason is 
because a review of the medical literature suggested Vista is asso- 
ciated with improved patient outcomes. This association is far 
stronger than with any other electronic health system. 

So, open source software allows one to see the source code. It is 
also freely available. So, there is licensing, but the license is free. 
The important points that surround that particular paradigm is 
that innovations can come from many sources. World Vista has 
partnered at times with Veterans Administration, Indian Health 
Service, with private vendors, and with other funders to get 
projects done. Sometimes — many times — it’s from volunteers. This 
collaborative development compounds the value and effectiveness of 
investments. 

For us, the idea of no licensing fees up front was very good, be- 
cause it cost less money to come to the table. The collaborate 
leveraging that you did around open source allows you to re-use 
interfaces that are open source that we developed with our practice 
management system and with our lab systems, for instance, can be 
re-used by other community health centers and offices, private of- 
fices, for just the cost of configuration and support. 

Vendor competition in open source is probably the strongest rea- 
son. As you know, proprietary software basically has what they call 
vendor lock. Once you decide to go with them, you’re pretty much 
stuck with them, even if you felt like it was a bad deal. It’s very 
hard to walk away. In fact, I would say that open source is defined 
by the ability to have vendor competition, so that if I am not get- 
ting what I need from my vendor, I can walk away from that ven- 
dor but not walk away from my system. That is very important, I 
think, and is one of the main reasons why we drove to open source. 

The other part was that physicians don’t prescribe medicine 
based on what drug representatives tell them. They use an evi- 
dence-based approach. So, the Institute of Health Care Improve- 
ment suggests that up to one-third of medical errors can be re- 
duced by appropriate application of technology. 

So, I started to wonder if there was an aspirin of EHR’s. To look 
for that, what I did was I did a literature research and found, 
hands down, that Vista has the strongest correlation between pa- 
tient outcomes and improvements, and the use of electronic soft- 
ware. 

What happened with us is — initially, this is — outcomes and cost 
productivity declined the first week to 50 percent. In 6 weeks it 
was back up to 90 percent. We are now at 100 percent productivity. 
We will have one year of production next month. 

All the functionality we hope for, including registry use for diabe- 
tes and asthma, is functional. We have clinical reminders and 
other — in medication interaction and allergy interactions. 
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We’re very cost conscious. We did this for $19,000, plus hardware 
costs, but that doesn’t include my time and hiring a trainer, and 
it’s not sustainable. What we believe is that sustainable costs 
would show a savings over proprietary systems of 30 to 50 percent, 
perhaps more if they were deployed in a networked environment, 
which we strongly favor. 

So, in summary, Vista is the aspirin of electronic health records. 
If it were a drug, every provider would prescribe it. But, just like 
generic aspirin, there is no drug representatives or lobbyists to sell 
it. Its effectiveness is clearly supported in the literature, but ad- 
ministrators don’t have time to read the literature, so they listen 
to the sales pitch and lobbyists. In the health care industry, that 
could cost lives. 

I believe we should hold ourselves to the same standard we hold 
physicians, and use the evidence whenever possible to evaluate and 
select technology solutions, not advertising and marketing. That’s 
why we chose the electronic health record that we chose. Thank 
you. 

[The prepared statement of Dr. King follows:] 

Prepared Statement of Matthew King, M.D., Chief Medical 
Officer, Clinica Adelante, Inc, Surprise, Arizona 

Background 

Clinica Adelante, Inc (CAI) is a Community Health Center located in the Phoenix, 
Arizona area. We have seven sites that serve both urban and rural populations and 
a mobile clinic that serves remote areas of Maricopa County. The clinic has 26 pro- 
viders, including family practice, pediatricians, internists, OB/Gyn, mid-levels, and 
dentists. We see about 32,000 individual patients annually and about 90,000 en- 
counters. 50% of our patients are uninsured, 40% Medicaid, 3% Medicare and the 
rest commercial insurance. We provide sliding fee services to those at 200% FPL or 
below. 

In 2000, I took over as Chief Medical Officer for the clinic. CAI was engaged in 
National Chronic Disease Collaboratives sponsored by HRSA. We used Wagoner’s 
Chronic Disease Management Model 1 to improve care for some of our diabetics and 
asthmatics, which has been successful in showing dramatic improvements in chronic 
disease outcomes. The model utilizes patient education, nationally recognized treat- 
ment guidelines, a rapid process change model known as PDSA cycles and a chronic 
disease registry. The registry is a critical piece of the model because it can be used 
to track the population and also provide a means for outreach. However, it is not 
designed to be used in the exam room with the patient, so the patient data needs 
to be entered manually into the registry later. This double entry of data — once in 
the exam room and once in to the registry — is error prone, time consuming and cost- 
ly- 

Our desire was to extend the model to everyone that walked into the door so that 
each patient could have their own personal health plan based upon their age, sex, 
risk factors and disease states. However, we faced two main challenges. First, be- 
cause the registries required double entry, we estimated that we would need to hire 
24 more data entry specialists; however, we did not have the funds to do so. Second, 
the time required to do the preventive health would have a negative impact on our 
revenue. We knew that we needed to find an EHR solution that was relatively inex- 
pensive and could support data entry into a registry without double entry; because 
it could be used at the point of care. 

The Search for an EHR Solution 

We started a search for an EHR. The search was disappointing: The products 
were very expensive, between $200,000 to $500,000, and they really didn’t perform 
chronic disease management out of the box well without expensive customization; 
and they were deployed in a consumer unfriendly environment that included con- 


1 Rothman AA, Wagner EH. Chronic illness management: what is the role of primary care. 
Ann Intern Med 2003;138: 256—61. 
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sumer hostile contracts, vendor lock, poor interoperability, and a licensing and sup- 
port structure that negated the natural leverage of collaborative networks. Because 
of my prior exposure to Linux and other open source products, I wondered if there 
were open source solutions that would address the clinic’s needs. 

I would like to stop for a moment to discuss what Open Source means in the con- 
text of Health Information Technology (HIT). Open Source software allows one to 
see the source code and is freely available. The Open Source license used by organi- 
zations such as WorldVistA guarantees that not only is the code available to be ex- 
amined, it is also available to be enhanced by the community and the enhancements 
cannot be lost or trapped in a proprietary product for the sole benefit of one vendor 
and its customers. Improvements must be donated back to the community of users. 
Enhancements to the code can come from volunteers, vendors, funded projects, IHS, 
VA, etc. These enhancements are checked by experts and only released after review. 
The important points here are that innovations can come from many sources, col- 
laborative development compounds the value and effectiveness of investments, and 
the processes are transparent, organized and safe. 

The following is a list of what we perceive through our direct experience to be 
some of the key benefits of the open source model in healthcare: 

(1) Software quality and standardization accelerated by transparency — The trans- 
parency of the code assures better software quality and conformance to coding 
standards and security. Security flaws are more likely to be found and quickly ad- 
dressed, often within hours of discovery. Non-conformance with open standards is 
not tolerated by both developers and users. 

(2) Rapid innovation and improvement-The improvement cycle needed to keep the 
software current in response to the dynamically changing healthcare environment 
is much more rapid than in proprietary business models. 

(3) Improvement driven by user needs — Enhancements and fixes are directly driv- 
en by what users need, not by marketing, shareholder or other non-healthcare re- 
lated priorities. Community Health Centers, for instance, can drive changes to up- 
date their UDS reporting, while a proprietary vendor might not have the business 
case to make the code changes. 

(4) Lower total cost of ownership — No licensing fees mean less upfront and lower 
total recurring costs. 

(5) Competition focused on service excellence — Flexible support fees mean greater 
chances to leverage technology. For instance, if support fees are fixed by number 
of servers, not providers, every provider assigned to that server will spread the costs 
over more and more users. In the traditional model, every provider added to the sys- 
tem will cost another license and more support fees. 

(6) Collaborative leveraging of resources to improve “products” — Open source 
means quality management tools, clinical tools, interfaces, training and deployment 
materials are all shared. Going forward, the costs to participate are less and less. 

(7) The ultimate competitive free market economy — Vendor competition in open 
source is not distorted by the effect of vendor lock in. Open source prevents vendors 
from actively and purposefully using closed code to maintain their advantage over 
clients. Vendor competition encourages fair support pricing, great customer service 
and innovation. It also provides the consumer with a way out if the vendor goes out 
of business or is not responsive. Open source is a simple survival of the fittest busi- 
ness ecosystem which is driven and focused by evidence based improvement of both 
health quality and costs. 

Taken in aggregate, these advantages create strong financial and quality incen- 
tives to join cooperative networks and collaborate. This in turn accelerates improve- 
ment of safety and quality through best practice sharing and reducing isolated is- 
lands of healthcare data. 

Our search for an appropriate EHR led us to VistA in 2000, while researching 
open source alternatives. Unfortunately, at the time it was nowhere near ready for 
easy deployment outside the Veterans Administration (VA) so we continued to 
search for a solid EHR in the usual ways, but found the process disappointing. The 
process is not unlike being detailed by a pharmaceutical representative, so I started 
wondering what I could learn by comparing the two. Most physicians don’t prescribe 
medicine based upon what the drug representatives tell them. Instead they use an 
evidence-based approach. This is now an expectation and considered a standard of 
care in medicine, because evidence-based medicine saves lives. According to the In- 
stitute for Healthcare Improvement, nearly one third of all medical errors could be 
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prevented by applying appropriate technology. 2 So applying technology can save as 
many lives as prescribing aspirin after a heart attack! I began to wonder, is there 
an aspirin of electronic health records? What does the evidence based literature say 
about EHR and impact on quality? Is there one in particular that stands out? 
Shouldn’t applying the medical evidence to the choice of HIT be the standard of care 
since it, like aspirin, can potentially save so many lives? What I found in the lit- 
erature shocked me. 

It turns out that a search of the peer reviewed medical literature shows that the 
VA VistA EHR system is one of the only EHR systems that has been associated 
with improved outcomes. By contrast, the literature says almost nothing about pro- 
prietary systems and outcomes. Moreover, VA’s costs only went up 0.8% between 
1995 and 2004, while Medicare costs increased by over 40%. 3 

Once we understood the role of VistA in the VA’s transformation and performance 
our search was over. In addition we also became aware of the CMS VistA Office 
EHR initiative, the WorldVistA not-for-profit and the efforts to adapt VistA for use 
outside the VA. This work would ultimately lead to WorldVistA providing a CCHIT 
version (WorldVistA EHR) licensed under an open source software license. The only 
open source EHR to achieve CCHIT certification is WorldVistA. . . . Suddenly the 
advantages of the open source model would be available using a CCHIT certified 
VistA clone! 

Clinica Adelante’s WorldVistA EHR Implementation Strategy 

So after applying evidence-based studies and recognizing the importance of an 
open source model in healthcare, we chose WorldVistA to do a demonstration 
project. We developed a relationship with WorldVistA and became a development 
site during the CMS project. A key contribution our site made was to pilot a full 
open source platform which included the open source operating system Linux, and 
the open source database GT.M to further cut licensing costs. 

We leveraged and made use of the extensive resources and documentation which 
the VA makes available through a number of public web sites such as the VistA 
University training materials. Other examples of leveraging the open source model 
include: 

• modifying an installation checklist found on the VA documentation website 
for our use to direct our installation efforts 

• developing an open source interface to our practice management system 
(PMS) for registration and scheduling 

• integrating test ordering and results reporting with our external reference 
lab; our providers order labs in WorldVistA EHR and the results return as 
discrete data directly into WorldVistA EHR 

• development of chronic disease registries that allow data to be entered at 
point of care and reported in many forms including a HIPAA-stripped form 
for uploading to state and national chronic disease databases 

• implementation of real time drug order checks, automated clinical reminders 
and automated provider alerts 

• development of pediatric templates, including state approved EPSDT forms 

We formed four teams, using our staff and external consultants to help with the 
work and build buy in, including our key stakeholders early in the process. We hired 
a clinician to a training role and hired trainers to train him. The preparation phase 
took 8 months and we went live August 10, 2007 in Surprise, AZ at our busiest clin- 
ic. 


Outcomes and Costs 

Initially, as with any intervention of this magnitude productivity declined ... in 
our case to 50% of our usual level in the first week, but it recovered to 85-90% in 
six weeks. We are now at 100% productivity at our first site. Our referrals depart- 
ment can now do 10-15 referrals per hour, compared to only 6 per hour before im- 
plementation. We don’t lose medical records any more and they are always available 
for the patient visit when we need them. We lost no staff or providers as a result 


2 Crossing the Quality Chasm: A New Health System for the 21st CenturyCommittee on Qual- 
ity of Health Care in America, Institute of Medicine, Washington, DC, USA: National Academies 
Press; 2001. 

3 Robert A. Petzel, Director, Veterans Integrated Services Network 23, Compelled to Act: it’s 

called survival, PowerPoint presentation, slide 14, available at http://www.amq.ca/congres2006/ 
pdf/Compelled to_Act -Robert Petzel.pdf. 
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of the project. Staff immediately loved the system, but the providers only tolerated 
it at first. Now, no provider desires to return to the old way or to paper charts. 

Our registry functions also appear to be very successful. We now have two reg- 
istries — one for diabetes and another for asthma — configured. Now 100% of qualified 
patients are selected automatically for entry by the computer. This will allow 
planned care to be scaleable to 100% of our patients without hiring extra data entry 
specialists. We will be able to provide outreach and improved chronic disease man- 
agement to a much larger population of patients. For instance, when we used the 
registry that required double entry, we were only able to use Wagoner’s model on 
about 800 diabetics. Now we can use it on all of our patients with Diabetes. That 
is over 3000 diabetic patients. We will also be able to extend the Chronic Disease 
Model to other types of chronic disease, like depression, coronary artery disease and 
hypertension. Eventually, we hope to give every patient their own personal health 
plan, using the VistA registry technology. 

We were very cost conscious with the first implementation. We had no special 
grants. Our development costs were approximately $19,000 dollars, plus hardware 
costs. This does not include the salary of the trainer. Nor does it include lost rev- 
enue from staff meetings and lowered productivity, or my time as project leader. To 
achieve this, I spent most of my administrative time, evening and weekends work- 
ing on the project. It is doubtful that others can expect to achieve what we did with 
the same budget, nor should it be so difficult to do the “right thing” by patients. 

Since the demonstration project, we have also implemented our EHR at another 
site and also with the (mobile) rural health team. We are developing a 16 week im- 
plementation cycle that can be staggered to allow two implementations in different 
phases. We have started a network with two other community health centers and 
a small safety net non-federally qualified clinic. Although the demonstration project 
allowed us to show clinical success and estimate reduced costs compared to propri- 
etary systems, the project has stalled without more funding. Our analysis of sus- 
tainable costs show a savings of 30 to 50% over proprietary systems, perhaps more 
as the network grows larger. Even so, this cost remains out of reach for most offices. 
Ultimately, we view the EHR as a tool to reduce medical errors, improve patient 
care and stabilize the costs of healthcare. Developing these strategies is possible 
with systems like WorldVistA EHR, but are unlikely to co-evolve on their own. Prop- 
er planning, adequate funding and well designed incentives are all necessary to 
drive projects like these forward. In fact, without more funding, we will not be able 
implement WorldVistA EHR across all our network sites. This network represents 
a quarter of a million patient visits a year — that is a lot of patients who we could 
be reaching and whose care we could be improving with health IT but which we 
cannot, because of lack of funding. 

Based on our practical experience, our view is that VistA is hands down the best 
system available, is the only solution backed by solid scientific evidence to prove it, 
and costs 50-70% of the costs of comparable proprietary systems. The fact that it 
is open source and was developed by with taxpayers’ money makes it a logical and 
very affordable choice for a large segment of the US health system. 

Health Improvement through health IT and the need for incentives 

Health improvement through health information technology is a tough sell to pro- 
viders in general because it temporarily affects productivity as providers learn how 
to use the system. Moreover, any cost savings (like less ER visits because of better 
control of asthma) are realized downstream from the user and tend to accrue largely 
to the patient and the health care purchaser. Incentives are a very powerful tool 
to effect change that successful businesses use all the time. In this context, it is the 
fastest way to increase the rate of provider adoption for health IT. 

Incentives certainly could increase the rate of adoption, but just giving incentives 
for EHR acquisition will not improve quality. Incentives must be tied to quality im- 
provement or reporting clinical measures to have the desired effect. Connecting of- 
fices through networks tasked with quality improvement would work. The most in- 
novative approach would be to move completely away from volume based reimburse- 
ment to value based pay. Pay for performance is a step in the right direction, but 
still relies on volume. 

However, it is important to note that quality incentives need an adequate HIT in- 
frastructure with enough connectivity and sufficient granularity to report clinical 
measures at the provider level. This is why as a first step, I believe it is important 
that provider incentives be tied to the adoption of EHR systems. I believe further 
that EHR systems should support these important clinical and quality reporting 
functions. 
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In addition, a provider might need time and support to get used to the system 
and learn to use it effectively. This is why I believe provider incentives should en- 
courage network membership. Networks are better prepared than small offices — 
much less solo practitioners working on their own — to evaluate EHRs for the nec- 
essary functions, have the capital to customize them as needed and the expertise 
to deploy them, secure them and support them. Networks can also better connect 
with existing HIE, Medicaid transformation grant projects, labs and other ancillary 
services, etc. Provider support and clinical improvement will be greater with net- 
work formation and will also achieve the goals of better connectivity and improved 
quality. 

Myths about VistA and open source applications 

Before I conclude, I want to dispel the many myths floating out there about the 
VistA system and open source applications in general. 

Myth #1: the M coding language is too old to be used in a modern healthcare sys- 
tem. This is false and most large proprietary healthcare vendors, Epic for example, 
use it. There are many innovations taking place outside the VA right now that show 
the robust and flexible nature of the M based code. 

Myth #2: Open source is unfair in a competitive market. Open source stimulates 
competition unlike proprietary systems whose goal is to lock in users and monopo- 
lize the market. Proprietary systems are only in a competitive market until the cli- 
ent signs on the contract line. Then the relationship becomes very lopsided. I have 
been to many Health Information Conferences and have listened to the best speak- 
ers. They always say deciding on a healthcare vendor is like getting married, be- 
cause it will be a long-term relationship. It is very difficult to change vendors be- 
cause of vendor lock. Then they talk in the remaining hour about all the “pre-nup- 
tials” you must get because you can’t trust any of the vendors. Open source has com- 
petition at multiple levels, but primarily on support services and training which are 
the most important factors in successful and sustainable adoption of a solution. In 
the case of WorldVistA EHR both large and small companies can compete against 
each other with the same a high quality, CCHIT system. Large companies are defi- 
nitely interested, too. For instance, a major US systems integrator has just won the 
contract to provide all of Jordan’s public health system (46 hospitals, 500 clinics) 
with the WorldVistA EHR. With open source vendor competition, you reduce price, 
eliminate vendor lock and improve customer service. Open source is a true free mar- 
ket. 

Myth #3: The VA code is too expensive to maintain. VistA, under the open source 
model has flourished. Clinica Adelante was able to fund an extraordinary amount 
of customization for a moderate amount of money. Moreover, these enhancements 
are available for other offices for the price of configuration and support. Some of the 
code done by WorldVistA has found its way back into the VA system. There is an 
extraordinary opportunity for governmental agencies like the VA and Indian Health 
Service to work with private businesses and not for profits to further their missions. 

Myth #4: Open source applications are more vulnerable to security breaches. Be- 
cause open source code is transparent, there is a myth that it is insecure. This has 
not proved true at all. Breaches are often a result of poor coding practices. The 
transparency of the code demands that peers code to the highest levels. Moreover, 
it is scrutinized by expert before it is released. The result is clear: Nobody runs anti- 
viral software on (open source) Linux, nor do they need to. Everybody runs anti- 
viral on Windows (closed code) and they would be crazy not to. Moreover, with so 
many eyes looking at the code, more security flaws are found before breach and 
more quickly corrected, often within hours. 

VistA is the aspirin of EHRs 

VistA is the aspirin of EHRs and if it was a drug, every provider would prescribe 
it. But just like generic aspirin, there are no “drug representatives” or lobbyists to 
sell it. Its effectiveness is clearly supported in the literature, but administrators 
don’t have time to read the literature. So they listen to the sales pitch and the lob- 
byists. In the healthcare industry, that could cost lives. In healthcare, when lives 
are at stake, I believe we should hold ourselves to the same standard we hold our 
physicians and use the evidence whenever possible to evaluate and select technology 
solutions . . . not advertising or marketing hype. And that is why Clinica Adelante 
chose VistA EHR. 
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Chairman STARK. Thank you. 

Mr. Jones. 

STATEMENT OF LEROY JONES, GSI HEALTH, PHILADELPHIA, 

PENNSYLVANIA 

Mr. JONES. Thank you, Mr. Chairman. My name is Lee Jones. 
I am the founder and chief executive of a company called GSI 
Health. It’s a health IT consultancy based in Philadelphia. In that 
capacity, I am involved in a number of industry and government- 
sponsored initiatives to bring about large scale interoperability 
among health care applications and enterprises. 

One role I currently hold is as senior advisor and architect for 
the New York e-Health Collaborative, which is building a statewide 
health information exchange, and has invested in excess of $100 
million thus far to do so. 

I am also the program director of the health information tech- 
nology standards panel, which — sounds as though many of you are 
already familiar with. It’s a Member organization that has over 400 
organizations from various corners of the health care industry who 
have come together to select standards for interoperability. I am 
grateful for the opportunity to testify before you today. 

As you noted, consumers in today’s global economy have become 
accustomed to instant access to information, and have hit a speed 
bump, if you will, on the information super highway when it comes 
to their medical records. It’s not as though the information doesn’t 
exist. There is certainly electronic representations of clinical 
records and administrative records. But often they are not able to 
be brought to bear at the time and place that they are needed. 

So, I have come to say today that that is changing. As you noted, 
Mr. Chairman, the Department of Health and Human Services has 
established several different initiatives in order to move this ball 
forward. They established American Health Information Commu- 
nity, which is a group of 18 government and business non-profit or- 
ganization leaders fostering the adoption of interoperable electronic 
health records throughout the country. 

In order to meet the community’s objectives, there is also the of- 
fice of national coordinator, which really is the implementation arm 
of what the community tries to do. The national coordinator has 
funded several initiatives which are well known at this point, and 
I will just name, so that we can get to my larger point. 

The first is to harmonize all the electronic standards for health 
care in the country. The health information technology standards 
panel, which I am involved with directly, identifies and selects the 
necessary standards that will bring about an interoperable ex- 
change of health care data. The panel then develops further guid- 
ance that we call interoperability specs, which really give instruc- 
tions for different vendors to build independent “instantiations” of 
software that will, when brought together, be interoperable with 
one another. 

So, without collusion, different vendors are able to be interoper- 
able, and have some guarantee of interoperability. That’s sort of 
the intention of the standard selection process. 

The second key initiative is to ensure that the electronic medical 
record, or the electronic health record, has a proper floor 
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functionality, that it can be defined, if you will, and that there is 
a place that one can go to in order to verify correct implementation 
of health care standards. 

So, the certification commission for health information tech- 
nology does exist for that purpose. So, it is not enough to say these 
are the standards that one should adhere to. We have to have a 
system that allows the verification that a vendor, in fact, used 
those standards and used them correctly, so that we can ensure 
interoperability. 

The third key initiative is to catalog all of the privacy and secu- 
rity paradigms that exist in different jurisdictions because, as we 
know, that is often a great barrier to interoperability, and there 
isn’t a clear cut silver bullet solution to solving how we reconcile 
those differences. 

So, the first step is at least to understand what those differences 
are, so that we can begin to understand how they might be har- 
monized. So, the health information security and privacy collabora- 
tion has been started by the Department of Health and Human 
Services to catalog those, and has spurred many efforts to remove 
key barriers to interoperability. 

Then, last, there is an initiative to establish a real health infor- 
mation exchange network, which both demonstrates feasibility of 
implementing interoperability standards in an effective way, as 
well as propagates their use broadly by connecting real systems to 
each other. So the Nationwide Health Information Network, or 
NHIN, as it’s sometimes referred to, orchestrates implementation 
of interoperable standards within the context of real world health 
delivery environments across different regions in the country. 

These efforts have now been established, and are complementary, 
and are coordinated as one system. They have established a domi- 
nant design whereby interoperability will continue to be achieved 
in an ongoing fashion, whereas no such systems existed like that 
prior to AHIC and ONC’s establishment. 

We now have an accepted system in place to harmonize and ad- 
vance appropriate standards. We now have an accepted system in 
place to verify correct implementation of those standards. We now 
have an accepted system in place to catalog our privacy and secu- 
rity differences. We now have an accepted system in place to iden- 
tify and ultimately remove barriers posed by these different as- 
pects. 

Over the past few years, these initiatives have demonstrated that 
it matters how the Federal Government participates, and not just 
that it participates. So, leveraging the familiar paradigm of con- 
sensus-based development, we have found that when people come 
together and are partly owners of the solution, as opposed to hav- 
ing solutions foisted upon them, they actually are more receptive 
and likely to do a good job in implementation. 

I think that the question before us is one of both supply and de- 
mand. On the demand side, there are many incentives that can be 
brought to bear in order to bring about — or to incentivize people to 
adopt technology. But demand increasing will increase supply in 
the market. However, we don’t just want an increase in supply, we 
want the supply to increase in a way that fosters interoperability. 
So that requires coordination. 
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So, what we have been focused on is trying to coordinate the sup- 
ply side of this, so that when that demand is increased through in- 
centives and other things, we are able to, in fact, supply that in 
an interoperable way. I thank you. 

[The prepared statement of Mr. Jones follows:] 

Prepared Statement of LeRoy Jones, GSI Health, Philadelphia, 
Pennsylvania 

Mr. Chairman and distinguished members of the Subcommittee, my name is Lee 
Jones, and I am the founder of GSI Health, a healthcare information technology 
consultancy. In that capacity, I am involved in a number of industry and govern- 
ment-sponsored initiatives to bring about large-scale interoperability among 
healthcare applications and enterprises. One effort I currently support is the very 
important work happening in New York State to create shared policies and tech- 
nical protocols for interoperability. This effort has over $100 million invested in a 
statewide collaborative process to develop a standards-based health information ex- 
change network among a number of regional efforts within the state. Additionally, 
I currently serve as the program director of the Healthcare Information Technology 
Standards Panel (HITSP), a volunteer-driven cooperative partnership between the 
public and private sectors that is working to ensure the interoperability of electronic 
health records in the United States. I am grateful for the opportunity to testify be- 
fore you today on the need for harmonized electronic data exchange standards and 
infrastructure to empower patients and healthcare providers. 

The Current Landscape of Healthcare Information Technology 

Through my years of work in healthcare information technology, I know that pa- 
tients are often treated by doctors with incomplete medical information. Patients 
often do not know their medications, their medical history or their latest laboratory 
results. Patients seek care from a wide variety of primary care providers, specialists, 
hospitals, clinics, laboratories, imaging centers and pharmacies — all of which have 
disconnected pieces of their medical record. 

Patients, providers and payers believe that communication among caregivers is 
key to delivering quality, personalized medicine. Many think that electronic records 
shared across the entire community of clinicians is key to care coordination. 

According to a national survey published earlier this month in The New England 
Journal of Medicine, only 17% of clinicians in the U.S. have a basic system of elec- 
tronic health records in their offices. Among the doctors who have access to elec- 
tronic health records systems, 97-99% report using all of the system’s functions at 
least some of the time. 1 However, data does not flow among all these systems partly 
because of the inconsistent use of data standards, lack of a consistent architecture 
for exchange of data, the lack of a trusted means to validate consistent and compat- 
ible implementations of standards and architecture, and the lack of agreement on 
privacy policies held by different jurisdictions. 

The Need for a Coordinated Approach Toward Interoperability Enablement 

Consumers in today’s global economy have become accustomed to instant access 
to information. News, music and movies can be accessed real-time on a handheld 
device. Products and services from multiple providers can be located, compared and 
purchased online. Financial accounts can be managed, bills can be paid electroni- 
cally, and funds can be withdrawn at ATMs anywhere in the world. 

When it comes to their personal health information, however, patients have felt 
a speed bump on the information superhighway. The records exist, but doctors, 
pharmacies, and insurance companies use disparate systems that make the ex- 
change of information slow and cumbersome, thus retarding timely access to the in- 
formation in the routine delivery of care. 

But all of this is changing. 

U.S. Department of Health and Human Services (HHS) Secretary Michael Leavitt 
has established the American Health Information Community (AHIC), a group of 
eighteen government, business, and non-profit organization leaders charged with 
fostering adoption of interoperable electronic records throughout the country. The 
AHIC has been essential to moving national interoperability efforts forward by ar- 


1 DesRoches et al {2008). "Electronic Health Records in Ambulatory Care — A National Survey 
of Physicians.” The New England Journal of Medicine, Volume 359(1):50— 60. 
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ticulating and prioritizing specific scenarios, often referred to as “use cases”, which 
focused industry efforts on specific and tangible areas where healthcare interoper- 
ability is needed and can be achieved through concerted work. Equally as important, 
the AHIC has served as a conduit to the Secretary of HHS to identify the results 
of the industry’s work to achieve interoperability in the areas of those use cases, 
so the Secretary can hold up said results for all Federal agencies and initiatives to 
leverage appropriately. These standards that the Secretary holds forth are known 
as “recognized standards” and have an appropriate lead time that enables testing 
and evaluation before achieving recognized status, which is when Federal partners 
are expected to use these standards. Thus, the first generation of recognized stand- 
ards have had that status for only slightly more than 6-months, and so we antici- 
pate increasing adoption and system interoperability as these standards are given 
a chance to be planned for and implemented in Federal and private-sector systems 
in an ongoing fashion over the coming months. 

In order for the objectives of the AHIC to be met in a purposeful and directed 
way, the HHS-based Office of the National Coordinator for Health Information 
Technology (ONC) has funded a coordinated effort to accelerate electronic medical 
record interoperability efforts. This effort is comprised of several symbiotic initia- 
tives, four of which I will mention here: 

The first is to harmonize all the electronic standards for healthcare in the coun- 
try. Currently there are more than a dozen organizations creating healthcare infor- 
mation standards in the U.S. These standards are at times redundant, competitive 
and non-interoperable. Further, sometimes there are no appropriate standards 
available to enable particular kinds of healthcare transactions. To achieve the kind 
of universal functionality our ATM cards provide today, the country must agree on 
a common set of healthcare information standards, implemented consistently by 
vendors and healthcare providers alike. The organization I support, the Healthcare 
Information Technology Standards Panel, or HITSP, has been sponsored by ONC to 
harmonize the relevant information standards, working with the various authoring 
organizations of these standards, industry stakeholders of all types, and affected 
Federal partners to disambiguate the use of standards when several compete, and 
to push for establishment of needed standards where none exist. 

The second key initiative is to ensure electronic medical records provide the basic 
functions needed for a doctor to record and transmit patient medical information. 
The average patient over 80 years old has ten medications and three clinicians. 
Rarely is there any coordination of care among caregivers to assist these patients, 
and others, with bringing to bear a correct picture of their health status (history, 
treatments, medications, current issues, etc.) into each new healthcare encounter. 
But in order for care providers to more easily share patients’ clinical information 
which may be held in their particular electronic health record systems, objective cri- 
teria to certify that an electronic record system meets the basic requirements for 
data capture and exchange is essential. The Certification Commission for 
Healthcare Information Technology, or CCHIT, provides certification and validation 
services that enable healthcare IT vendors and implementers of various kinds to 
verify the correctness of their implementations of interoperability standards and key 
system functions. 

The third key initiative is to catalogue privacy and security policies across the na- 
tion toward the end of reconciling their variances in a manner that enables inter- 
operability. In Massachusetts, for example, doctors cannot retrieve a complete elec- 
tronic medical list from insurance companies, even with patient consent, if a medi- 
cation related to mental health, substance abuse or HIV treatment is present. In 
Ohio, doctors must use a cryptographic electronic signature to prescribe medications 
electronically. In California, only paper signed consent forms (not electronic forms) 
are considered a valid patient consent. The laws that created many of these regula- 
tions were appropriate 30 years ago when electronic systems lacked the sophistica- 
tion available today, but now are an impediment to delivering safe, patient focused 
care. The Health Information Security and Privacy Collaboration, or HISPC, has 
begun this cataloguing effort and has spurred many efforts to remove key barriers 
to interoperability related to divergent privacy and security practices. 

The fourth key initiative I will discuss here is to ensure that a real health infor- 
mation exchange network is established which both demonstrates the feasibility of 
implementing interoperability standards in an effective way, as well as propagates 
their use broadly by connecting real systems. All standards are merely theoretically 
useful until proven through real implementation. The Nationwide Health Informa- 
tion Network, or NHIN, orchestrates implementation of interoperability standards 
within the context of real-world health delivery environments across different re- 
gions in the country. Often, these implementations involve a number of vendor prod- 
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ucts and platforms that adopt the desired standards through NHIN, and subse- 
quently spread them through their normal channels in the marketplace. 

These four ONC initiatives plus the AHIC are critical to the rapid advancement 
of healthcare interoperability for several reasons. 

First, prior to the government becoming actively involved in this type of public/ 
private partnership through the activities of ONC, interoperability efforts through 
the standards development organizations’ activities alone led to a highly fractured 
system that was not converging in any meaningful way. Therefore, the Federal Gov- 
ernment must stay involved in the process for ultimate success to be achieved in 
moving the entire industry. 

Second, the model AHIC and ONC have been cultivating over the past few years 
has shown that it matters how the Federal Government participates, not just that 
it participates. Leveraging the familiar paradigm of consensus-based development 
and adoption of standards in the United States has led to wider participation and 
buy-in than has been achieved through other methods such as unassisted market 
forces or heavy-handed mandates. It is important to allow private sector entities 
have ownership in the process of developing the interoperability solutions they will 
need to implement. It is most effective when they can innovate around, and adopt 
standards and architecture in a manner where their incentives are aligned with the 
collective goals. 

Third, these efforts have now established complementary and coordinated systems 
that have set the dominant design for how interoperability will continue to be 
achieved in an on-going fashion whereas there were no such systems prior to AHIC 
and ONC. We now have a system in place to harmonize and advance appropriate 
standards. We now have a system in place to verify correct implementation of those 
standards. We now have a system in place to develop and proliferate the technical 
network to interconnect healthcare partners. And lastly, we now have a system in 
place to identify and ultimately remove barriers posed by divergence in privacy and 
security practice. 

Lastly, the efforts of the AHIC and ONC have inspired smaller-scale replicas to 
emerge around the country. The AHIC use cases are reused or customized for local 
interoperability efforts. The consensus processes used for standards harmonization 
are mimicked by regional efforts that need to arrive at their own technology blue- 
prints. In the parlance of the internet community, the current national interoper- 
ability initiatives are “viral”. 

For the balance of this testimony, I will provide further details around the areas 
I am most involved in, namely establishing interoperable networks and architec- 
tures, and harmonizing interoperability standards. The intention here is to convey 
a greater insight into how these initiatives are operating to foster understanding of 
why the current efforts are working well. 

Health Information Exchange Networks 

I am currently involved in two significant efforts to establish networks that enable 
the exchange of healthcare information among various healthcare software applica- 
tions. These efforts are to build the Statewide Health Information Network of New 
York, called the SHIN-NY (pronounced “shiny”), and the Nationwide Health Infor- 
mation Network, called the NHIN. These efforts are actually related inasmuch as 
the SHIN-NY is intended to be a microcosm of the NHIN in New York. The devel- 
opment of technical infrastructure through these projects is catalyzing the adoption 
of interoperability standards and actual data sharing among providers. 

Building these networks is a complicated undertaking. Not only do different sets 
of standards need to be integrated, but additional elements beyond information 
standards need to be “standardized”, such as technical methods associated with all 
networks (e.g. — ensuring the reliability of the and availability of the network). It in- 
volves deciding what technologies are ready for implementation, what level of back- 
ward compatibility will be supported, and what emerging technologies are likely to 
persist enough to include in the technical plan. 

The NHIN has published a number of technical specifications regarding the de- 
tailed handling of not only healthcare standards, but also methods for communica- 
tion in the transmission of messages, security techniques, as well as paradigms for 
distributing functionality across the network without centralized control (critical for 
quick adoption where policy hurdles regarding centralized control may abound). The 
NHIN has also established a shared testing environment that may be leveraged 
broadly to ensure accurate utilization of interoperability standards. There are over 
ten participating regions and entities in the NHIN, including Federal partners, vol- 
unteer organization, and regional teams funded by ONC. This pioneering is an im- 
portant step in realizing ubiquitous interoperability. 
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The SHIN-NY is leveraging the work of a number of different efforts to achieve 
its goals in New York. It has modeled its local business cases on the published 
AHIC use cases, and has even extended them to encompass local concerns such as 
the utilization of Medicaid data in data exchange. It has also taken the HITSP 
interoperability standards and incorporated them into the design of statewide net- 
work, further entrenching these important specifications. New York is participating 
in an initiative sponsored by the Centers for Disease Control and Prevention to im- 
plement a biosurveillance system using the corresponding AHIC use case and 
HITSP standards, and this work is integrated into the SHIN-NY effort as well. And 
finally, as a participant in the NHIN, New York is leveraging the technical speci- 
fications, testing environment, and experience the NHIN has amassed over the past 
few years. In addition to all of this leverage of existing work, the SHIN-NY will 
contribute its own technical protocols and services that will be usable across New 
York and beyond. 

These efforts both have designs to not only establish technology that will be inter- 
operable, but also to serve as reference implementation models for other efforts to 
learn from and to reuse. The learning, including much of the design and some of 
the new software from these initiatives will be made available in the public domain. 
This will fuel the fledgling open source projects in healthcare as they are the most 
likely to leverage these new assets. Whether it is bolstering the open source assets, 
or transforming the landscape of commercial products as they integrate into the net- 
work, these significant initiatives to build networks for information exchange are 
propelling the industry forward into a more interoperable state. 

The Role of the Healthcare Information Technology Standards Panel 
(HITSP) 

“Within ten years, every American must have a personal electronic medical record 

— President George W. Bush, April 26, 2004 

When President Bush called for every American to have an electronic health 
record by 2014, he was outlining his vision for a healthier nation. To help make this 
vision a reality, the public and private sectors are working together to define and 
build an information network that would support the secure exchange of health data 
across the United States. 

In the fall of 2005, the HHS Office of the National Coordinator for Health Infor- 
mation Technology (ONC) awarded multiple contracts to advance President Bush’s 
vision for widespread adoption of interoperable electronic health records (EHRs). 
The contracts targeted the creation of processes to harmonize standards, certify 
EHR applications, develop nationwide health information network prototypes, and 
recommend necessary changes to standardized diverse security and privacy policies. 

As coordinator of the U.S. voluntary consensus standardization system and proven 
provider of standards-based solutions to national and global priorities, the American 
National Standards Institute (ANSI) was selected to administer the standards har- 
monization initiative, in cooperation with strategic partners the Healthcare Informa- 
tion and Management Systems Society (HIMSS), the Advanced Technology Institute 
(ATI), and Booz Allen Hamilton. The resulting collaborative, known as the 
Healthcare Information Technology Standards Panel (HITSP), brings together rep- 
resentatives of the private and public sectors to make possible the interoperable ex- 
change of health care data across the United States. 

The Panel’s work is driven by a series of Use Cases (i.e., business needs) that are 
issued by AHIC. Based on the needs outlined in each Use Case, HITSP develops 
guidance documents known as Interoperability Specifications (IS) that recommend 
the standards that will meet the defined clinical and business requirements for 
sharing information across organizations and systems. During this process, HITSP 
also identifies and documents any gaps in standards which must be resolved. 

Once an IS is recognized by Secretary Leavitt, agencies administering or spon- 
soring federal health programs are required to implement the standards where ap- 
plicable. These work products (IS) are intended to be supportive to the developing 
Nationwide Health Information Network (NHIN) for the United States and also to 
community and regional health information exchange networks. 

HITSP is a volunteer-driven, consensus-based operation. The Panel’s 480 member 
organizations represent consumers, health care providers, public health agencies, 
government agencies, standards developing organizations, and other stakeholders — 
all working together to identify the most appropriate standards for specific use cases 
involving patients, providers, and government agencies. HITSP is committed to an 
open and transparent mode of operation and to facilitating standards harmonization 
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efforts that support interoperability, accurate use, access, privacy and security of 
shared health information. 

The Standards Harmonization Process 

HITSP’s most important work is the development of a well-defined, repeatable 
process to identify the most appropriate standards for each AHIC use case. 

A standard specifies a well-defined approach that supports a business process and 
has been agreed upon by a group of experts, has been publicly vetted, provides 
rules/guidelines/characteristics, helps to ensure that materials, products, processes 
and services are fit for their intended purpose, is available in an accessible format, 
and is subject to an ongoing review and revision process. Harmonization is required 
when a proliferation of standards prevents progress rather than enables it. 

In some cases, redundant or duplicative standards will be eliminated. In other 
cases, new standards may be established to span information gaps. In all cases, the 
resulting standards serve the consumer and other healthcare stakeholders by ad- 
dressing issues such as data accessibility, privacy and security. 

Our process to date is: 

a. AHIC and its working groups develop Breakthroughs. 

b. AHIC Working Groups or other customers prepare a HITSP Harmonization Re- 
quest. 

c. HITSP Technical Committees identify candidate standards, which are har- 
monized into a final list of standards. They also identify overlaps and highlight 
gaps. Gaps are forwarded to standards developing organizations for their guidance 
as to emerging candidate standards or new standards requirements. 

d. HITSP Coordinating Committees provide technical committees with important 
background information to support their work, such as objective criteria to evaluate 
the appropriateness of standards for a given purpose. 

e. The final chosen standards produced by the Technical committees are discussed 
and ratified by the full Panel. 

f. These standards are made available for public comment and feedback. 

g. Technical committees work with standards developing organizations and other 
groups to produce detailed specifications, an unambiguous “cookbook” for the imple- 
mentation of chosen standards. HITSP provides a convening and facilitation func- 
tion for this activity. 

h. HITSP work products are delivered to AHIC for their endorsement. 

i. After AHIC endorses HITSP work, the Certification Commission on Healthcare 
Information Technology will include HITSP specifications in its certification work. 
Hospitals and clinicians will be more likely to buy products, which are certified as 
interoperable. This will lead to increased success of vendors, which embrace stand- 
ards and interoperability. 

Progress to date and next steps 

The first priorities assigned to HITSP were in the areas of Electronic Health 
Records (EHR) (e.g., the electronic delivery of lab results to providers of care), bio- 
surveillance (e.g., data networks supporting the rapid alert to a disease outbreak), 
and consumer empowerment (e.g., giving patients the ability to manage and control 
access to their registration and medication histories). In January 2007, HHS Sec- 
retary Michael O. Leavitt accepted HITSP’s recommended standards, known as 
“Interoperability Specifications (IS)“, for a one-year period of implementation test- 
ing. In January 2008, the Secretary announced his formal recognition of the HITSP 
IS. 

According to Executive Order 13410 signed by President Bush in August 2006, 
federal agencies administering or sponsoring federal health programs must imple- 
ment any and all relevant recognized interoperability standards. These standards 
also become part of the certification process for electronic health records and net- 
works. 

Three additional sets of HITSP IS — Emergency Responder-Electronic Health 
Records; Consumer Access to Clinical Information; and Quality — were accepted by 
the Secretary for implementation testing in January 2008 and new IS on Medication 
Management was submitted to the Secretary for acceptance in Spring 2008. 

New work is also underway to address interoperability needs in six additional 
areas: personalized health, transfer of care, remote monitoring, secure communica- 
tions between patients and providers, public health case reporting, and immuniza- 
tions and response. 

The HITSP Education, Communications and Outreach Committee has strived to 
educate interested stakeholders on the future of healthcare information technology 
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and how the public can shape the standards that will promote interoperability. This 
summer, the Committee is sponsoring an educational webinar series that informs 
the public of the work that is currently underway to support the exchange of 
healthcare information in the U.S. 

Beyond 2008, HITSP will continue to produce recommendations and reports in 
Interoperability Specifications and related Constructs. These work products are in- 
tended to be equally applicable to the developing Nationwide Health Information 
Network for the United States (NHIN) and also to community and regional health 
information exchange networks. 

From consumers to doctors, nurses and hospitals; from those who develop health 
care IT products to those who use them; and from government agencies to organiza- 
tions that are developing the standards upon which these new health systems are 
based — everyone has a role to play in shaping the new U.S. healthcare IT infra- 
structure. 

Thank you very much for your attention, and I look forward to any questions you 
may have. 


Chairman STARK. Mr. Whitlinger. 

STATEMENT OF DAVE WHITLINGER, DIRECTOR OF 

HEALTHCARE DEVICE STANDARDS AND INTEROPER- 
ABILITY, INTEL CORPORATION 

Mr. WHITLINGER. Thank you. Good morning, Mr. Chairman, 
and fellow Members of the Committee. My name is David 
Whitlinger, and I am the director of health care standards at Intel. 
I appreciate the opportunity to appear before your Committee to 
testify on promoting the adoption and use of health information 
technology. 

Let me start by saying that I am honored to be here, rep- 
resenting Intel Corporation in this important health care informa- 
tion technology discussion. 

As many Members of the Committee may know, Intel has been 
a major contributor to the worldwide information technology sector 
for 40 years now. As a corporation, we have participated in the 
transformation of countless industries as they have adopted PC’s, 
data servers, high-speed communications networks, data visualiza- 
tion tools, wireless networks, and other information technologies to 
increase their productivity, improve efficiency, and thereby achieve 
greater quality in their products and services. 

What industry sector is in greater need, if not dire need, of high- 
er efficiency and productivity — and, perhaps most importantly, 
measurable quality — than the U.S. health care industry? As you 
are all well aware, our nation currently spends nearly two times 
as much as any other country in the world on health care, weighing 
in at roughly 16 percent of our gross domestic product, or $2.2 tril- 
lion. Without a dramatic change, we are on course to hit $4.3 tril- 
lion within 10 years. 

Health care IT is obviously not the silver bullet that will single- 
handedly overhaul our Nation’s health care industry, but broad in- 
dustry adoption of information technologies will improve effi- 
ciencies, increase productivity, reduce costs, and give us all quality 
measurements that we can be nationally proud of. 

So, first, we commend Secretary Leavitt for his recognition and 
commitment to health IT by his development of a strategic plan 
that lays the groundwork for the transformation to higher quality, 
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more cost-efficient patient-focused health care through electronic 
health information. 

We would like to see Congress provide a framework to ensure the 
continuation of the Certification Commission for Health Informa- 
tion Technology, known as CCHIT, and the Health Care Informa- 
tion Technology Standards Panel, known as HCITSP, and encour- 
age industry organizations that are at the forefront of consumer or 
patient-centered health care, like the Continua Health Alliance. 

The Continue Health Alliance is an industry-led consortium of 
over 160 companies that is driving personal health care interoper- 
ability through standards and certification testing for health de- 
vices like blood pressure cuffs, glucose meters, pedometers, weight 
scales, personal computers, and cell phones. These are the personal 
health devices that can help an individual become empowered to 
better manage their own health, thereby reducing their dependency 
on the health care system itself, and at the same time improving 
their overall health: empowered, informed, healthy citizens. 

Second, we would strongly encourage Congress to develop finan- 
cial incentive programs to jumpstart health care IT implementa- 
tions across the nation. We commend the Ways and Means health 
Subcommittee for challenging the current system by considering di- 
rect incentives for providers of Medicare and Medicaid services to 
convert from the paper-based, inefficient, and at times dangerous 
systems, to using the technologies we take for granted in every 
other industry. 

As a large self-insured employer, we are willing to step up, and 
we have in certain regions where we have large concentrations of 
employees. But we need government partnership to support more 
transformational programs, create the financial incentives to move 
the entire U.S. health care system to an electronic health care 
record that can help increase efficiency of the health care pro- 
viders, increase accessibility of patient health data across pro- 
viders, and provide a foundation for a quality measurement system. 

How can we improve the quality of health care in our country, 
or even measure what we are providing our citizens for $2.2 trillion 
without data? Congress should explore reimbursement options for 
health care providers in the Medicare program that will facilitate 
the use of health information technology for quality improvement, 
and evaluate the benefits of providing grants and loans to pro- 
viders to help reduce the barriers to investment and future health 
IT solutions. 

Last, I would like to speak to you, as a large employer. With over 
60,000 employees here in the United States, we, unfortunately, are 
on track to spend close to $1 billion on health care for our employ- 
ees in the next couple of years if something doesn’t change. 

We look forward to working with Congress to improve the effi- 
ciency of our nation’s health care system, to help keep U.S. compa- 
nies competitive, and improve the quality of health care in this 
country to a level that we can all be proud of. Thank you. 

[The prepared statement of Mr. Whitlinger follows:] 

Prepared Statement of Dave Whitlinger, Director of 
Healthcare Device Standards and Interoperability, Intel Corporation 

Thank You. Good morning Mr. Chairman and fellow members of the committee. 
My name is David Whitlinger and I am the Director of Healthcare Standards at 
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Intel. I appreciate the opportunity to appear before your committee and to testify 
on technology in U.S. healthcare. 

The topic discussed today is of utmost importance. Not only does our nation cur- 
rently spend almost two times our nearest competitor per capita on healthcare, but 
the costs are having a dramatic effect on the ability of U.S. businesses to remain 
competitive in an ever growing global economy. At approximately 16% of the GDP, 
we can no longer afford to move ahead with business as usual. Unless something 
is done soon to dramatically overhaul our broken healthcare system, the coming age 
wave and rise in chronic conditions will overwhelm our ability to pay for and pro- 
vide the kind of care we expect in this country. Further, we do not get better results 
for our $2 trillion dollar spend. U.S. healthcare fails to stand up to comparison on 
a wide range of quality measures with other mature countries. Clearly something 
has to change. Spending more or providing less is not a solution. We need to provide 
better care at lower total cost. 

I represent Intel, a large U.S. technology company which has helped transform 
countless other industries utilizing the power of information. Today, you and I reap 
the benefits of years of investment and work to put the power of information di- 
rectly in the hands of consumers. It’s hard for some of us to remember life before 
personal computers, cell phones, portable music players, and in-car navigation sys- 
tems. 

Additionally, Intel is a large U.S. employer with headquarters in the Silicon Val- 
ley which currently employs approximately 60,000 U.S. citizens. We are on a path 
to spend $1 billion annually on healthcare within the next few years. Just the an- 
nual cost of healthcare for an Intel employee and family of four exceeds the fully 
loaded cost (including salary and benefits) of one qualified engineer in many devel- 
oping nations. Our employees are our greatest resource. We need the best and 
brightest minds working on the challenges of the 21st century. 

Because we, as an employer, pay into the system in three ways via corporate 
taxes, employee benefits and the cost shift from the uninsured, we see healthcare 
as an issue that must be addressed and solved if U.S. business is to remain globally 
viable and able to provide quality jobs and benefits to our employees and bene- 
ficiaries. 

Healthcare Missed the Revolution 

Intel has been at the center of technology change for 40 years, driving efficiencies 
in every part of the economy. The PC and the Internet have literally changed the 
world — they have changed the way we communicate, the way we access information, 
the way we conduct business, and the way we entertain ourselves, except for one 
critical industry, healthcare. Paul Otellini, Intel’s CEO, cites Intel’s work in the 
health industry as a case in which our technology and leadership may help resolve 
some of society’s thorniest issues. By reducing the cost of healthcare “the single big- 
gest opportunity we have — to address the single biggest problem that certainly the 
U.S. and many of the Western countries are going to have — and ultimately the 
world.” 

Intel Employer Initiatives 

Not only has Intel seen the value of investment in the infrastructure necessary 
to keep our products on the cutting edge of future demand, we also have seen the 
value of investment in our own people. 

In 2005, Intel, Cisco and Oracle launched an effort to incrementally change the 
way employers pay for healthcare services for our employees. The program, known 
as the Silicon Valley Health IT initiative, is a collaborative effort among seven large 
IPA’s (Independent Practice Associations) representing 25 distinct practice sites and 
more than 1,800 physicians. The goal is to help the system shift toward a more pa- 
tient centered approach with rewards for the use of IT to provide better communica- 
tion, care and follow-up. 

Early data has shown promising results and each year the bar is raised to drive 
toward NCQA (National Committee for Quality Assurance) guidelines and patient 
satisfaction. We’ll continue to look for ways to lead the change around how we pay 
for the care provided to our employees and their dependants. 

As we know, action follows money. Different outcomes require that we rethink 
how we pay for care in the U.S. We need to transition from the fee-for-service tread- 
mill that is driving more and more providers out of the profession. As funders of 
the system, the ones who actually write the checks, we have the power to work with 
the delivery system to help align the incentives and reward the right care. Simple 
examples are electronic prescriptions, electronic communication between patient and 
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clinician, remote diagnostics and monitoring, electronic health records, etc. Addition- 
ally, Intel has made the commitment to deploy on-site clinics for our larger facilities. 
We are combining these clinics with a renewed emphasis on employee health and 
wellness. While these clinics are not a new concept, we believe it is another step 
toward establishing a culture of wellness and convenience to our associates. 

Dossia 

Intel is also one of the founding members of Dossia, a non-profit organization ini- 
tiated by a consortium of large U.S. employers for the purpose of creating a national 
system to deliver lifelong, personal, private, and portable health records for their 
employees. The focus is to leverage employers as the purchaser of healthcare serv- 
ices and place the health data into the hands of employees and their families with 
a strong firewall between the employee records and the employer. This will be a na- 
tional platform that will provide personal control to the employee over an inde- 
pendent, non-tethered view of their patient information. With a complete picture of 
their health, employees will be free to exercise more choice and thus drive competi- 
tion for the higher quality, patient-centric healthcare. 

Federal Leadership 

We believe government has to help lead the way toward systemic transformation, 
by developing new care paradigms and new financing alternatives. 

Given the enormous technology advances in all other industries, it’s time for 
healthcare to reap the same benefits and it will take leadership by the Federal Gov- 
ernment partnering with private industry to provide funding, and standards to pro- 
mote an open architecture for health IT interoperability. We commend Secretary 
Leavitt for his recognition and commitment to Health IT by developing a strategic 
plan that lays the groundwork for the transformation to higher-quality, more cost- 
efficient, patient-focused health care through electronic health information. We want 
to see Congress provide a framework to ensure the continuation of CCHIT and 
HITSP, organizations at the forefront of federal Health IT. 

Congress has been actively engaged through the Senate HELP and House Energy 
and Commerce committees developing opportunities for loans, grants, and pilots to 
stimulate the deployment of electronic medical records. The Medicare Reform bill 
passed last week follows a path recommended by AHIC (American Health Informa- 
tion Community) to provide incentives for Medicare/Medicaid doctors to move elec- 
tronic prescriptions. 

With U.S. healthcare spending at $2.2 trillion, $7K/person, 16% GDP, and 4 times 
the spending on national defense, and 125 million citizens facing chronic disease, 
60 million with multiple conditions, the state of the U.S. healthcare system de- 
mands a more comprehensive approach. 

We commend the Ways and Means Health Subcommittee for challenging the cur- 
rent system by considering direct incentives for providers of Medicare and Medicaid 
Services to convert from the paper based, inefficient and inherently dangerous sys- 
tems to using the technology we take for granted in every other industry. It’s not 
just about routers, wireless Voice over IP (VOIP) and telehealth equipment and elec- 
tronic medical records. Transitioning to a data rich environment provides an oppor- 
tunity for improved tracking, analysis and understanding of expenses and outcomes 
that drive healthcare decisions. How do you track quality improvements without 
data? How do the oversight committees realistically appraise the state of healthcare 
in the U.S. or set benchmarking standards for reimbursement schedules without 
electronic medical systems? And more importantly, how are patients cared for with- 
out a holistic understanding of their diagnosis, testing and treatment? 

Think Y2K, when the Federal Government working with industry, avoided a melt- 
down of the economy through funding and partnership in a highly technical area. 
Federal Government leadership played another key role in the healthcare industry 
when the Federal Government’s decision to move to electronic billing records revolu- 
tionized not only the Medicare/Medicaid payment systems, but provided leadership 
for the private payers as well. Purchasing power of the Federal Government will 
move the meter nationwide. 

Case Example: Banner Health IT 

I’d like to share a case example of one hospital’s experience after deciding to inte- 
grate technology in the construction and operation of their facilities. Banner Estrella 
Medical Center in Phoenix combined clinician-designed workflows, extensive train- 
ing, with a cultural change to save the system $2.6 million through: 
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• Improvements in nurse retention 

• Decreased incidence of adverse drug events 

• Reduced length of stay 

• Fewer patients leaving the ED without treatment 

• Reduced days in A/R 

• Decreased expenses 

The patient experience improves dramatically as well. Patients aren’t asked the 
same questions over and over again — the first clinicians to interview a patient chart 
the information, and everyone on the care team is able to review the information 
digitally. Clinicians don’t waste time chasing after paper charts, and when they con- 
sult with other clinicians, each person can simultaneously access the charts. Clini- 
cians use wearable Voice-Over-Internet Protocol phones (VoIPs), so patients’ sleep 
isn’t interrupted by frequent overhead pages. Nurses have a more comprehensive 
view of patients, so they are better able to develop a comprehensive plan of care 
to advance the patient in his or her recovery. Even many clinicians who were reluc- 
tant adopters of a paperless system now say they would never want to work in a 
paper-based hospital again. 

Offering incentives to convert to a health IT platform for Medicare and Medicaid 
providers offers the opportunity to change the healthcare system in a dramatic way, 
both qualitatively and through cost savings. We urge the Ways and Means Com- 
mittee to act now to find the right combination of payment incentives, tax benefits, 
pilot programs and low cost loans that will elevate the world’s costliest system into 
the world’s best healthcare system. 

Value of Measurements and Interoperability 

One of the critical gaps in today’s existing health care IT is the lack of standards 
and interoperability. Hospitals and clinics have no shortage of expensive advanced 
technology, but often these devices do not communicate with each other. X-Rays and 
test records are not portable between doctors or health systems. Tests are often re- 
peated unnecessarily, wasting money and time while the patient waits for a critical 
decision. 

As President of the Continua Health Alliance, a worldwide non-profit, open-indus- 
try coalition of healthcare and technology companies, I am pleased with the progress 
our 250 members have made to voluntarily develop a system of standards that will 
promote harmonization of personal health products. We have just announced a set 
of Bluetooth standards that will promote wireless interoperability of these products. 

Back to the Future — Home Centered Health Care 

Over 70 million aging baby boomers could overwhelm the U.S. healthcare system 
and engulf the nation’s tenuous economy, according to a new study, “Will the Boom 
Bust Health Care?,” by management consulting firm Tefen USA. Internationally, 
the United Nations shows the number of people aged 70 and older doubling in 25 
years to 1.2 billion in 2025. 

Recognizing the impact of these demographics, Intel researchers launched an un- 
precedented study of seniors and chronically ill patients in 1999. Our ethnographic 
researchers have observed and interacted with more than 150 hospitals and clinics 
and 1,000 households in 20 countries. We became passionate about enhancing inde- 
pendence and finding solutions to help individuals, family members and caregivers 
stay in touch with the people they care about. We are learning that consumer edu- 
cation combined with home computers, wireless networks, televisions and cell 
phones offer new ways to increase prevention, early detections and caregiver assist- 
ance. We are designing systems that better connect to information interaction, safe- 
ty and security, and health and wellness. Through ongoing monitoring and patient 
education, we can begin to shift the process of improving outcomes while keeping 
patients at home and independent. 

While the bulk of health care today is delivered in hospitals and clinics, today’s 
acute care-centered system is ultimately unsustainable in the future. 

The old one-on-one physician to patient paradigm will not suffice. We need to 
move away from the physician-centered care delivery paradigm toward a patient 
centric model where delivery and funding are channeled via care teams with a com- 
munity approach toward care. IT is a powerful enabler to help provide the care nec- 
essary to meet this tide head on. 

Intel’s goal for healthcare solutions is to connect people and information across 
the continuum of care to improve healthcare and quality of life. Interconnected per- 
sonal health innovations will keep people healthy and living at home longer, and 
help individuals, families, and the extended healthcare community, and connect to 
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the right information at the right time. These new technologies will empower people 
to make better, more informed health decisions and become an integral part of the 
healthcare system. 

Global Health Race 

Between now and 2013 the EU and the private sector will invest more than €lbn 
in research and healthcare innovation for older people. Some €600m is to be in- 
vested in the ambient assisted living program, while a further €400m is included 
in the EU’s latest research framework program. In addition, about €30m in research 
funds have been made available this year under the European Union’s ICT Policy 
Support Program. 

Through an unprecedented partnership with the Irish government Intel launched 
the TRIL (Technology Research for Independent Living) Centre creating one of the 
largest research centers of its kind. This active research collaboration between in- 
dustry and academics drives knowledge transfer through the collective work of mul- 
tidisciplinary research teams. The TRIL Center is building an open, sharable re- 
search platform and co-invents new technologies for older people and their families. 

The U.S. shows evidence of quickly being left behind in this global marketplace 
largely ignoring, avoiding or under-investing in aging-in-place and home health 
R&D. One exception is the Oregon Health and Science University Biomedical Engi- 
neering Lab developing technologies for early detection and remediation of aging 
changes. The university is using biosensors to continuously monitor seniors’ move- 
ments and develop new ways of detecting cognitive impairment. Another example 
is CAST, the Center for Aging Services Technologies, a partnership Intel co-founded 
with the not-for-profit long term care advocacy group AAHSA, the American Asso- 
ciation of Homes & Services for the Aging. From the White House Conference on 
Aging to several demo days in the Senate, CAST, now with more than 500 care pro- 
viders, technology companies, and universities involved, has brought national and 
international visibility to the needs of older people, their families, and their physi- 
cians. 

By adopting a platform of innovation and care for the “age wave,” U.S. businesses, 
governments, and NGO’s have the opportunity to not only create centers of excel- 
lence but also provide a new economic frontier serving the U.S. and across the globe. 

Once again, thank you for acknowledging the role of the Federal Government in 
accelerating the U.S. adoption of a robust and effective health IT ecosystem. We 
look forward to working with the Committee as you develop policy incentives to en- 
sure that the U.S. becomes a center of excellence. 


Chairman STARK. I want to thank the panel very much. This is 
a problem that actually has concerned some of us on the Com- 
mittee for over 15 years. I think it was Mr. Gravitts and I who had 
talked about outcomes research more than 15, 20 years ago. 

I have a feeling that that is impossible to develop, unless we 
have some kind of universal database, and we can find out what 
happens — not whether you survive a procedure, Dr. King, but what 
happens 5 years after the procedure? Which procedure is better? 
Unless we have some kind of database, we’re just never going to 
know. 

Peter, could you address the issue of the incentives that you 
think are necessary from two points? One, my sense is that doing 
it through the tax code leaves out the not-for-profit segment of the 
provider community. So, that leaves a big hole, if that’s where 
we’re going to do it. Second, the smaller providers, the solo practi- 
tioners, the small, very small groups — less than five, let’s say — that 
Dr. Ejnes’s group represents, don’t see the same “savings” that Kai- 
ser Permanente sees. I mean, Kaiser can use their own system, as 
they do now, and probably save a whole lot of money. But, for a 
solo practitioner, that’s not as good. 
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Well, how could we incentivize these two different extremes? Can 
we do it any other way? You say the stick. I’ve suggested that we 
start with a supplement, and that means Dr. King and others who 
spent money already get some of it back. Because whatever system 
we pick isn’t going to make — 90 percent of the people are going to 
be unhappy because it isn’t their system, and they’re going to have 
to make some changes and adopt. 

Those who don’t have a system we’ll front-end load it, and then 
glide down to zero subsidy and — in 5 years, say — and then in the 
subsequent 5 years, start penalties. So, you get 5 years and some 
money they get into the system, and then if you’re not in it in 5 
years, we start to penalize. It would be a system — could you com- 
ment on those ideas? 

Mr. ORSZAG. Sure. First, I think it is, for context, important to 
realize that the entities that find it most beneficial — the integrated 
health plans — have already largely adopted. These institutions are 
behaving rationally. Those that see the largest benefits from this 
have been the leaders in adopting it. 

With regard to the Tax Code, you’re right that non-profits — you 
have to either be — leave them out, or be very clever about transfer- 
ability, about clever — and it creates problems in the Tax Code — in 
extending benefits to non-profit entities. So, I will leave it at that, 
but you are right to identify that as a significant issue in any tax 
incentive that is intended to provide help to non-profits. 

With regard to solo practitioners, I guess there is this tradeoff, 
which is unless you’re going to provide massive subsidies — you 
know, $20,000, $30,000, $40,000 or more for those solo practi- 
tioners — you are going to wind up in a situation in which they are 
going to bear some costs that are not fully reimbursed, or fully off- 
set, and it’s really up to you. 

I mean, I believe that the only way we’re going to get to nearly 
universal adoption is ultimately with some stick, as it were, or 
some penalty, if you will, as the e-prescribing legislation did. You 
can easily, if you wanted to, offset most, if not all, of the costs up 
front. It’s just you’re going to be bearing larger budgetary costs in 
doing that. That’s obviously a choice that would be up to you. 

What I would say, though, is it seems unlikely that, unless you’re 
going to have very, very large budget costs, that you’re going to get 
nearly universal through purely the carrot approach. 

Chairman STARK. Well, you are right. We have been faced re- 
cently with a series of ads — I’m not sure who is running them — in 
the Post showing us the “$1 billion profits” that some of these not- 
for-profit systems are making, and the $6 million and $8 million 
and $12 million annual paychecks that the chief executive officers 
of some of these large — you’re not one of those, are you, Dr. King, 
getting 

Dr. KING. I’m wondering where I can apply. 

Chairman STARK. Me too. But — and I suspect they’re the ones 
that already have the system, and they can well afford it. 

I wanted to go to Dr. King and maybe Mr. Whitlinger. I am 
happy to say, Mr. Whitlinger, I just found out that my Mac just 
crashed due to a RAM chip, but Intel didn’t make it. We think 
Samsung did, but I will recommend to Steve Jobs that you make 
those chips, and then maybe the darn thing will work better. 
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But, Dr. King, you use Vista, that you just — the one that the Vet- 
eran’s Administration has, and makes available for anybody for 
free? 

Dr. KING. Well 

Chairman STARK. Or an iteration of it? I don’t 

Dr. KING. An iteration. Basically, what happened is because it 
was developed by the VA, you can obtain Vista under the Freedom 
of Information Act. That particular — the way it is when it comes 
to you, it’s not very practical. So 

Chairman STARK. Somebody said that somebody out there in 
the world is rewriting it, the Vista program, to bring it into — and 
here, my 13-year-old would have to explain to me the technology — 
but rewriting it in a form that would be usable in modern-day com- 
puters. 

Dr. KING. Well 

Chairman STARK. It, too, will be available, free. 

Dr. KING. Well, what happened was — it’s sort of already hap- 
pened — the CMS had a grant, and was able to take the Code and 
open source it through this grant, so it could be used in an office- 
based setting. 

Chairman STARK. Okay. 

Dr. KING. That was developed by World Vista 

Chairman STARK. Now, if I am a patient in your clinic. 

Dr. KING. Yes. 

Chairman STARK. I go to Kaiser in Oakland, can they access — 
they have IPIC, or something like that — could they access my 
record in your clinic, if I happened to be in Oakland and needed 
treatment? 

Dr. KING. Today they could not, no. 

Chairman STARK. It’s my understanding that if I am a patient 
in the Veterans Administration, and I end up in an emergency 
room at Oakland, if they have my password and code, they can — 
the doctor in the emergency room at Pilot Hospital in Oakland — 
could get on the Internet and get my Vista records. Is that your 
understanding? 

Dr. KING. My understanding is they could go and get the patient 
health record 

Chairman STARK. Yes. 

Dr. KING [continuing]. That the patient actually has entered, 
but not the electronic health record that Vista has. In other words, 
there is a 

Chairman STARK. I thought they could, but I am 

Dr. KING. Only if they have access — that system is locked down 
pretty well. 

Chairman STARK. Okay. 

Dr. KING. Unless you have all the access, and — it would not 
work. 

Chairman STARK. Would not something of that nature be desir- 
able — and I ask the physicians on the panel — at some point for 
treating emergencies and/or treating people who move from a pri- 
mary care doc to a specialist, to have, as Vista does, all the — imag- 
ing is electronic, so there is no paper image any more, but film im- 
ages. You can just get all of this out of the ether. Would that not 
be an advantage to practitioners? Dr. 
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Dr. EJNES. Yes, it would be. In fact, I would argue that the full 
potential of physicians adopting electronic health records will not 
be achieved until we get there. The — and this is what’s going on — 
I mean, I’m involved — I’m also on the board of directors of the 
Rhode Island Quality Institute, which is a recently designated 
RHIO, and that’s something we are trying to do within the state, 
is to get the hospitals, the labs, other physicians, to be able to ex- 
change information. 

It doesn’t require everybody at the user end have the same soft- 
ware, just as you can access the web on your Mac and I can on my 
PC. But the concept of the exchange is key to our success. 

Chairman STARK. Yes, I think you say it, and I would be con- 
cerned Mr. Jones’s clients, and Mr. Whitlinger, while we — each per- 
son here — may have a different e-mail — I use AOL personally, but 
something else here in the House, but I can get to my AOL mail 
on a Mac or a PC in the airport, if I get into the — you know, borrow 
somebody’s. So, it’s — to that extent, that is my definition of — I can 
have a separate little program that either encourages pornography 
or sorts spam, or whatever it wants to do, but I can do that from 
any computer that is available. Is that what your clients — is that 
what you suggest to your clients, Mr. Jones? 

Mr. JONES. Yes. We certainly try to bring about interoperability 
without reducing the freedom of choice of the particular end user 
point solution. I think that, you know, and electronic health record, 
in this regard, is sort of akin to that, an end user point solution. 

Chairman STARK. Ms. McGraw, I am not avoiding you, but I 
know some of my colleagues know much more about the privacy 
law than I do. 

Ms. MCGRAW. Okay. 

Chairman STARK. Even — some of them went to law school, so 
they understand really the nuances of it, which I don’t. As a bank- 
er, I sued George Schultz when he was Secretary of the Treasury, 
because he was trying to get into the bank records, and it went to 
the Supreme Court, and I lost. But nonetheless, that’s the last time 
I got involved in privacy issues. 

Are there any of the witnesses who feel that we could get to a 
database that I think we all desire for research, sanitized for pri- 
vacy protection, and that would save the money that Dr. Orszag 
suggests that we could get, without the Federal Government — or 
perhaps AMA, I don’t know — somebody saying, “This is the system 
in which everybody must participate?” 

On the other hand, is there anybody who thinks that would be 
a disaster, in terms of free enterprise and getting where we want 
to get? 

I can — anybody want to — that’s my last question. Mr. Whitlinger, 
you’re the biggest free enterpriser, next to Dr. Orszag here, in 
terms of money that you spend. How would Intel come up with 
that? 

Mr. WHITLINGER. Well, certainly, there are interoperability 
standards being developed, and that are being implemented, that 
would allow us many, many systems across the nation that could 
be linked together and provide us the functionality that would be 
necessary to provide the physicians with the ability to transport 
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health records back and forth, in order to serve their patients and 
to also have a secure private network that you describe. 

Chairman STARK. Dr. Ejnes. 

Dr. EJNES. Yes, Sir. If you are referring to everybody adopting 
the same electronic health record application, for example, I think, 
based on what’s out there today, and the needs of offices today, I 
think I would say disaster. 

Having been through the process a couple of years ago of weed- 
ing through the hundreds of different products, it’s very clear that 
if you’ve seen one practice you’ve seen one practice. Certain physi- 
cians want all the bells and whistles, others want “Bring it out of 
the box and let me use it.” The types of practice, locations, and 
other needs really dictate which product is the best one. The certifi- 
cation commission has played a major role in helping to narrow 
down the choices for us, as well as have us poised for interoper- 
ability. 

But I think, unless it were a product that didn’t exist today, to 
have it be the universal one, even if it were inexpensive, would be 
problematic. 

Chairman STARK. Let me follow that up, because I am afraid I 
don’t have the vocabulary to adequately deal with this. But my as- 
sumption would be that I could get the entire organized medical 
fraternity and sorority to nod with me if we started with age, 
weight, blood pressure, cholesterol, all those kind of empirical 
things that we all have in our psyche, okay, or in our physiology. 
So, I don’t think there is any quarrel there. We say, “Okay, every 
record has got to have my name, race, age, sex,” you know, all the 
stuff. Okay? 

Beyond that, I also think we could agree that, as Vista does, all 
the pictures, or whatever they take of us — CAT scans and all, x- 
rays and that sort of stuff, can be stored digitally. So, no quarrel 
there, right? 

Dr. EJNES. Right. 

Chairman STARK. Now, as to my program for — my schedule in 
Congress has a place where my wife can get in touch with my 
scheduler and add the shopping list for Fresh Fields that I am sup- 
posed to pick up on the way home. That might not be required in 
every system, but the ability to do it could very well be there with- 
out disadvantaging — can’t we get to some level where — and then, 
let the specialities — it’s my understanding that thoracic surgeons 
and the anesthesiologist do have a database of more than half of 
all the procedures performed in the last 5 years. That’s pretty good. 
But I don’t think there are many others that do that. Is that a 

Dr. EJNES. Yes. I think that’s 

Chairman STARK. I mean, doesn’t somebody have to outline 

Dr. EJNES. Yes. 

Chairman STARK [continuing]. That system? 

Dr. EJNES. Yes. I think what you are getting at is the develop- 
ment of standards. 

Chairman STARK. Okay. 

Dr. EJNES. I think we have made a lot of progress. This is not 
my field, but 

Chairman STARK. Then what I should say is somebody has to 
define the standard. 
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Dr. EJNES. Yes. I think we have. I mean, there are standards 
that exist for communicating a lab report, an image, you know, the 
patient — discharge somebody from the hospital, and that’s come out 
of these different collaboratives that were described by the other 
panelists. 

So, yes, I think that has to be the foundation for whatever then 
is acquired by the physicians, just as, you know, TCPIP is the way 
that we communicate data across the Internet. So, whether you 
have a Mac, a PC, a Blackberry, you’re able to communicate. 

Chairman STARK. Do you have a feeling on this, Mr. Jones? 
Your clients, what would they say about all of this? Or what do you 
say to your clients about all of this? 

Mr. JONES. I think that the last point is exactly right, that we 
are — you know, if I made an analogy, we don’t want to tell every- 
one they have to drive the same car, because some people — or the 
same motor vehicle — because some people need a pick-up truck and 
some people need, you know, to be compact, et cetera. But we do 
want to define what a car is, that it moves, it has wheels, it has 
a steering wheel, et cetera. 

So, in that sense, I think that this system that you’re describing 
is, in fact, the selection of standards that would govern how a car 
operates. You know, there could be enforcement about various 
things: You must have seatbelts for safety, you know, et cetera. 

Chairman STARK. We don’t have that yet, do we? 

Mr. JONES. Well, what we do have is a number of different 
standards development organizations that all are trying to define 
that car. Sometimes they define slightly different cars. 

So, what we have tried to do in HITSP is to bring them to the 
table and say, “You know, this is really — let’s compromise, and this 
is really what the definition should be about a car.” So, I think that 
there is not a lack of standards. In many cases, there may be “too 
many standards.” So we need to select and harmonize them. 

Chairman STARK. Would it be helpful for, say, the Federal Gov- 
ernment to establish a standard and say, “Here it is, guys, and now 
let’s all figure out how we can compromise to work on one stand- 
ard?” 

Mr. JONES. Well, I think that the Federal Government is doing 
that through the sponsoring of HITSP. The establishment, in this 
case, is to bring the Federal stakeholders and the private stake- 
holders together to agree and say it’s not an option to not agree. 
“We will move forward, whether you are at the table or not, but 
you have the opportunity to come to the table, and we will agree 
that this” 

Chairman STARK. We have to complete that, then. 

Mr. JONES. Absolutely. 

Chairman STARK. Okay. Mr. Camp, would you like to inquire? 

Mr. CAMP. Well, thank you. Being from Michigan, I certainly 
like these car analogies. I hope — and what my bill tries to do is ac- 
tually codify what these groups are doing at HHS, and bring them 
together to come up with standards. 

But also, I think it’s important that we have the people who 
build cars at the table. So, we do need to have a viable private sec- 
tor role in this. I don’t think people in the government know how 
to define a car without the help of the people who build the cars. 
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So, that’s why I think we are trying to strike this balance in the 
legislation that we have. 

I do just want to mention that Dr. Reding, who was going to tes- 
tify here on behalf of the Marshfield Clinic, they have 40 years of 
IT development at their — in their experience, and they didn’t re- 
ceive any direct Federal funding to pursue HIT. But they did ex- 
press concerns about the privacy language, and the commerce bill, 
or the Protect Act that is moving through. Really, this idea that 
there is a limited data set of data that is moving forward, they be- 
lieve would certainly affect peer review, quality review, quality im- 
provement, standard of care review. 

So I do think, while this privacy issue is a complex one, I think 
we have to make sure that we keep certain simple truths in place, 
and that is this idea that those involved in health care can consult 
with others in health care for the purposes of treatment, this im- 
plied consent issue, that we don’t erode that to the point where we 
hurt those positive things that are moving forward. 

But let me just say, Dr. Orszag, you know, from your testimony 
I got the sense you feel that society, as a whole, is spending enough 
on health care, in terms of a percent of our economy. Is that some- 
thing that you — in your comments, that’s what I drew, at least, a 
conclusion. Would that be a viable conclusion of your comments? 

Mr. ORSZAG. Well, I don’t know whether we’re spending enough 
or not. What I do know is we could be getting a lot more from what 
we’re spending. 

Mr. CAMP. So, we are not getting value for what we are spend- 
ing. 

Mr. ORSZAG. We are not getting enough value 

Mr. CAMP. So, we are spending too much for what we get. 

Mr. ORSZAG. That is correct. 

Mr. CAMP. Now, you mentioned that — this idea of a non-inte- 
grated and integrated system — and for those of us who may not be 
the policy wonks that others are — traditional Medicare is a non-in- 
tegrated system, correct? 

Mr. ORSZAG. Traditional Medicare pays for non-integrated 
care 

Mr. CAMP. That’s a yes? 

Mr. ORSZAG. Yes. 

Mr. CAMP. Medicare Advantage is an integrated system, correct? 

Mr. ORSZAG. Medicare Advantage 

Mr. CAMP. Much like an HMO is an integrated system. 

Mr. ORSZAG. Could be, yes. It depends on the exact definition 
of an integrated 

Mr. CAMP. So you would conclude that integrated systems, like 
health HMO’s, better realize benefits from HIT than non-integrated 
systems like Medicare. That’s a conclusion you draw in your report. 

Physicians, you mention, have little incentive to adopt HIT. 
Should we incentivize them to do that? 

Mr. ORSZAG. I am going to leave the “should” up to you. What 
I would say is if you want to capture this — you want to improve 
the efficiency in the health system, you need to get toward more 
universal health IT. You can do that, again, in a variety of ways. 
You can provide a positive or a negative incentive. I guess I could 
put it that way. But we do need to change the incentives. 
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Mr. CAMP. All right. Dr. King, the Marshfield Clinic believes 
that Congress should subsidize the use of health IT through Medi- 
care, to promote the rapid adoption of those systems. You men- 
tioned that just 3 percent of your health system patients are Medi- 
care beneficiaries. So, this means that a clinic like yours would see 
very little support from health IT. 

Is this a good use of taxpayer dollars, in your opinion, for 

Dr. KING. For the 

Mr. CAMP. The beneficiary? 

Dr. KING. Yes. I think that incentives are extremely important 
to get adoption. However, I think you have to do it in a way that 
drives improvement of care at the same time. Just handing out 
money for people to buy electronic health records I think will lead 
to large failures, a lot of wasted money, and you won’t get what you 
want. 

Mr. CAMP. Dr. Orszag, if physicians were paid based on the 
quality and appropriateness of care they delivered, would they be 
more likely to see financial incentives associated with adopting 
health IT? 

Mr. ORSZAG. Yes. 

Mr. CAMP. That would be a good thing? 

Mr. ORSZAG. Yes. 

Mr. CAMP. All right. Thank you. Thank you, Mr. Chairman. 

Chairman STARK. Mr. Doggett, would you like to inquire? 

Mr. DOGGETT. Thank you, Mr. Chairman, and thanks to each 
of our witnesses who have offered some valuable insights into this 
complex issue. I certainly agree with Dr. Orszag, that we cannot 
begin to get at — effectively — the $700 billion of waste in the system 
unless we have information technology. We won’t get information 
technology unless part of the incentives are strong negative incen- 
tives. We will simply be encouraging people who are already mov- 
ing toward health IT, and not getting at those who have been re- 
sistant to the idea. 

My concerns, though — and I will address probably all my ques- 
tions to Ms. McGraw — concern the question of privacy. 

You are well aware that this is not the first time, as all our wit- 
nesses are, that this Committee has considered information tech- 
nology. In 2006, I joined with Mr. Emanuel and some of our other 
colleagues in offering an amendment to the bill that was up then, 
designed to protect patient privacy. On the floor, I offered that lan- 
guage, and I have not seen anything since then. 

In fact, quite a bit of evidence supporting our concern about pa- 
tient privacy that would suggest that, in this legislation, we should 
lower the bar and denigrate the standard that was set in the 
Emanuel amendment, and the language that I offered on the floor. 

I find that, despite the efforts yesterday of Congressman Ed Mar- 
key, that there are a number of provisions in the legislation ap- 
proved in the Energy and Commerce Committee that are troubling. 
I thought, Ms. McGraw, that your point was well taken in your tes- 
timony, that proper standards for privacy are not an obstruction to 
information technology, which we want. They, in fact, can enable 
that. 

Indeed, wouldn’t you agree, Ms. McGraw, that, unless there are 
appropriate privacy safeguards in this legislation, we won’t get the 
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kind of honest, complete data that we need, both from practitioners 
and from patients, feeling that they can have confidence in telling 
their physician what their situation is, particularly in the mental 
health area, unless they can be sure that their personal data is pri- 
vate, and shared only between medical health care practitioners, 
and not sold off to some data mining company? 

Ms. MCGRAW. Right. No, of course, I completely agree with you. 
You know, one out of every six people in this country practice what 
are called privacy protective behaviors because of their fear about 
how their health information could be used to harm them. That is 
particularly true for people who are dealing with conditions that 
are frequently stigmatized, or have sought care that really, you 
wouldn’t even want your neighbors to know about. 

So, essentially what that means is that people either won’t go to 
the doctor, they will lie to their doctor, or they will ask their doctor 
to be careful about what goes in the record, or they will see mul- 
tiple providers to avoid all of the data being in one record. Of 
course, if we are going to all be electronically connected, that be- 
havior obviously won’t be as fruitful as it once was for people who 
are really concerned about their privacy. 

The problem is that that person doesn’t necessarily get good care, 
because the physicians and the providers who care for them need 
that information. So, there is bad data, essentially, in the record. 
That also hurts us in our efforts to measure care quality — and use 
of data for population health purposes, because you have some bad 
data streams in there. 

So, I agree with you, that it’s important to pay attention to this. 

Mr. DOGGETT. Exactly. We want the data stream to go — to 
allow us to set good policy, to allow for treatment insuring between 
practitioners. But we don’t want bad data that grows out of fear 
that privacy is being invaded. 

I note that the bill that was approved in the Commerce Com- 
mittee yesterday, though it makes repeated reference to privacy, 
does not define privacy. 

Ms. MCGRAW. Yes. Well, to be quite frank, I think that the 
focus on a definition of privacy is, again, far less important than 
setting forth some very clear parameters on how information can 
be used by health care providers, and how it can’t be used. 

There is actually, within the privacy community, a great deal of 
difference of opinion on if you were to define what privacy is, what 
that would be. So, we could spend a lot of time debating that, and 
still not — you know, and not come up with a good set of privacy 
and security protections. I think our focus is better put on 

Mr. DOGGETT. Would you agree 

Ms. MCGRAW [continuing]. Setting that framework. 

Mr. DOGGETT [continuing]. That, again, looking to the Com- 
merce bill, that patients should be able to give consent before iden- 
tifiable prescription records are shared with insurance and phar- 
maceutical companies? 

Ms. MCGRAW. Well, again. We worry a bit that the focus on 
consent diverts us from the more important issues. Let me explain 
myself, because I — consent is an important part of a comprehensive 
privacy and security framework for protecting data. But it’s only 
one part. 
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In fact, if we sort of pin all of our hopes or our plans for privacy 
and security on patient consent, we will, unfortunately, provide 
people with very weak privacy protection. Because, in the health 
care context, people don’t actually have a right to say no. If you are 
coming to your health care provider and you need care, they need 
the information to treat you. It’s not a situation where you can say, 
“Well, you can’t use my information to do this.” 

It also puts all of the burden on the individual to protect their 
own privacy, counting on them to read the consent form, under- 
stand what it says, sign it at the bottom, and then hope that actu- 
ally what they have signed at the end of the day actually does pro- 
tect their privacy in ways that they think it does. There is plenty 
of research that shows that people actually completely misunder- 
stand what they read. 

I would much rather have a focus on creating some very clear 
rules about how providers can and can’t use data, and penalties as- 
sociated with the misuse of that data. 

Mr. DOGGETT. Seeing the red light is on, and understanding 
that consent, by itself, may not be sufficient to protect privacy, it 
would appear that in the Commerce bill, that doctors, concerning 
certain procedures, must obtain consent from patients before shar- 
ing this data. Is that your reading? 

Ms. MCGRAW. The — it is for health care operations 

Mr. DOGGETT. Right. 

Ms. MCGRAW [continuing]. Which is a defined term in HIPAA, 
which isn’t treatment and isn’t payment, but is instead this sort 
of — I call it almost back office, things associated with treatment 
like a peer review, quality assurance 

Mr. DOGGETT. You agree with that consent requirement? 

Ms. MCGRAW. I have some concerns about it, to be quite honest. 
Again, the focus — people will be — the consent forms, people — again, 
they don’t read them, they don’t understand them. What they end 
up being is potentially a shield for uses of data that would, again, 
be much better protected if we had some clear rules around how 
entities can and cannot use data. We worked with Committee staff 
to try to make that provision more clear, to make sure that it was 
linked to the minimum necessary rule. But, again, I still have some 
concerns about that provision in the bill. 

But, having said that, CDT does support the Energy and Com- 
merce legislation and moving it forward, because we think there 
are some very important privacy and security protections in there. 

Mr. DOGGETT. But not necessarily without some changes. 
Okay. 

Ms. MCGRAW. We would encourage some changes. But, again, 
our support was not qualified. I don’t want to be misunderstood. 

Mr. DOGGETT. Thank you. 

Chairman STARK. Thank you. Mr. Johnson, would you like to 
inquire? 

Mr. JOHNSON. Thank you, Mr. Chairman. You know, when 
you’re following on that conversation, when you’re talking with spe- 
cialists — and there are a heck of a lot of them out there these days, 
as you know — the docs have to coordinate with one another. That 
information has to be passed. 
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You know, Dr. Orszag, you repeatedly state that physicians have 
little incentive to adopt health IT, and state that physicians may 
actually have a disincentive, because the systems can lead to a re- 
duction in the number of unnecessary tests and services. You have 
been a proponent of that, and claim we’re spending too much 
money. 

If this is the case, then why are any physicians spending their 
own money to implement health information technology? There is 
a doctor practice in my district that was so motivated to implement 
an electronic health record, that they went from paper charts to 
paper free in three short months. They broke even on the invest- 
ment in 18 months, and have reported a significant addition to 
physicians’ annual income as a direct result of the technology. If 
they’re doing fewer tests and services, which you state is the case, 
then they’re making more money from something else. From all the 
conversations I have had with physicians who have adopted this 
technology, the scenario is not a one-time phenomenon. There hap- 
pens to be 17 physicians in that group that did that. 

Is this an inherent disincentive that dissuades physicians, or just 
that there isn’t enough people out there, trying to get the equip- 
ment or associations or organizations spreading the good word of 
what technology can do for them? Do you have a comment on that? 

Mr. ORSZAG. Well, Mr. Johnson, as has already been asserted 
by the Chairman, I suppose in some settings I am a strong believer 
in the power of incentives and free markets. I will just look at the 
evidence. Ten to twenty percent of physicians have adopted. So, 
yes, there are some that find it in their interest to do so. But the 
vast majority don’t, under the current system. 

The kinds of settings where there are — it is profitable to do so, 
there might be some losses from ordering fewer tests, but you save 
on administrative efficiencies. You may not need as many support 
staff to process things. You can often get internal efficiency benefits 
that offset any other effect. 

I would just come back, though, to saying in the current system 
we are clearly not getting take-up rates that are anywhere near 
what most people believe would be optimal. I don’t think that is 
from a lack of health IT providers or vendors, you know, going out 
there and saying, “We have these things that may help you.” I 
think it is from complexity, and I think it’s from a lack of direct 
incentives for especially small practitioners to adopt. 

Mr. JOHNSON. Well, I think we could appeal to physicians as 
small businessowners, and let them use the Tax Code to deduct the 
cost of the technology if they wanted to, and perhaps entice them 
that way. But it sure is a lot simpler dealing with a doc that has 
got that kind of data. I know the docs here know that. 

But you know, in Dallas, for example, you can — if you happen to 
have a doc that’s got that IT installed, you can go to the hospital 
and you don’t even have to fill out forms, because they can pop that 
stuff over there right now. 

Mr. ORSZAG. I don’t think there is a person on this panel or in 
this room who is not annoyed at how many times you have to fill 
out forms when you go see a new doctor. We all are 

Mr. JOHNSON. 18,000 times. 

Mr. ORSZAG. Yes. 
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Mr. JOHNSON. Yes. It seems like the forms are duplicative. In 
the hospital, it is even worse, you know? 

Mr. ORSZAG. Yes, Sir. 

Mr. JOHNSON. There is a stack of them this high. So, if we can 
get rid of that, and the storage required for all that paper, it would 
be a marvelous improvement in our medical system, I think. 

Thank you, Mr. Chairman. I will yield back. 

Chairman STARK. Thank you, Mr. Johnson. Mr. Thompson, 
would you like to inquire? 

Mr. THOMPSON. I would. Thank you, Mr. Chairman. Thanks 
for holding the hearing, and thanks to the witnesses, for being 
here. 

I have got some concerns about how we make health IT available 
in the areas that I represent, specifically our rural areas. Dr. 
Orszag, you referenced the Robert Wood Johnson work, and they 
mention the fact that rural hospitals are 50 percent less likely to 
be able to have health IT, and that solo practices, which are, more 
often than not, in rural areas, fall under some pretty heavy con- 
straints. It’s more than just coming up with the capital to put this 
in place. There is maintenance, there is constant upgrades. Small 
practices, rural practices, rural hospitals don’t have the oppor- 
tunity or the ability to have a full-time IT manager in place. 

How do you — what recommendations do you suggest that we 
make sure we don’t hurt these guys in our effort to help them, and 
help health care? 

Mr. ORSZAG. Well, the report that you referenced, CBO’s report, 
also mentions that one thing you could do is, if you are going to 
go with the carrot approach, or the subsidy approach, you can vary 
it. 

So, for example, provide a larger subsidy to solo practitioners 
than to large practices. Or, I suppose you could also offer a larger 
subsidy to regional hospitals than to urban hospitals, for example. 

But I would again come down to the fundamental problem here 
is there is a lot of the benefit that is going to accrue from having 
a more universal system of health IT that is not going to be 
capturable — or directly capturable — to, say, that regional hospital. 
There is a national benefit here, in terms of capturing efficiencies 
in health care that will not — it will be very difficult to have it flow 
back to that hospital. 

So, there is this problem in that there is a national benefit and 
an overall benefit, and it’s not exactly the same thing as the benefit 
to that regional hospital. That’s just the way it is. It’s very hard 
to come up with a way of returning that overall efficiency gain to 
all of the doctors that will be necessary in order to capture it. 

Mr. THOMPSON. Well, I am very worried that we understand 
that, and even in regard to the carrot approach, that we don’t think 
that we can give some sort of incremental increase in funding, 
based on visits or something to pay for that. Because the rural 
guys also don’t have the amount of folks coming in for visits that 
more populated areas do. 

Also, in the area — in the issue of interoperability, I would just be 
interested in hearing maybe Mr. Jones, if you could comment on 
this. In my rural district, I have doctors that — one doc will work 
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in three or four different hospitals in three or four different areas 
that will be out of county, out of city. 

In your work in regard to interoperability, do you take this into 
consideration, and — the cross-jurisdictional boundaries? 

Mr. JONES. Yes. I think that there are a few aspects to that. 
One is people are realizing these days that there was a lot of en- 
ergy focused on trying to reconcile patient data, given that patients 
go to multiple places. But the same is true for providers. 

So, I think that similar technology that allows you to reconcile 
who this patient is can also allow you to reconcile who the doctor 
is, so you can pull the information from 

Mr. THOMPSON. So, you would envision interoperability that 
crosses jurisdictional boundaries, and every city would have the 
same electronic ability, every county, every area where you would 
get this cross-pollenization? 

Mr. JONES. I think, from a technology standpoint, yes. I think 
what starts to become the barrier are the policies that those dif- 
ferent jurisdictions have to work out, in order to facilitate that. 

Mr. THOMPSON. I have been involved in the — in California, in 
bringing technology forward for programs such as the welfare pro- 
gram in California. You couldn’t get cities to agree — let alone coun- 
ties to agree — on what type of technology you would use. I would 
just think it would be very difficult for individual hospitals, and es- 
pecially individual hospitals run by individual companies, and op- 
erating in different geographical areas. 

Mr. JONES. Yes. I think that it does require a focused set of 
policies for this purpose of interoperability. That’s what we found 
in New York, for example, in some of the RHIO’s. Hospitals may 
have different policies about how they correct errors in patient 
data. But when it came to the community-wide view of that data, 
they had to have a separate policy that allowed them to have a 
common understanding of how that data would be treated. So, I 
think it has to be purposeful in that way. 

Mr. THOMPSON. Thank you. Thank you, Mr. Chairman. 

Chairman STARK. Mr. Becerra, would you like to inquire? 

Mr. BECERRA. Thank you, Mr. Chairman. Thank you, to the 
panel, for your testimony. 

Mr. King, let me start with you. My understanding is you have 
a very low percentage of your patients who pay through Medicare. 

Dr. KING. About 3 percent. However, 40 percent is Medicaid. 

Mr. BECERRA. Right. But Medicare is about 3 percent? 

Dr. KING. That’s correct. 

Mr. BECERRA. How many patients would you say you see in a 
year in your different clinics, roughly? 

Dr. KING. We see 32,000 total patients, individual patients 

Mr. BECERRA. Okay, and 

Dr. KING [continuing]. In all the clinics combined. Is that the 
question? 

Mr. BECERRA. Yes, that’s fine. 

Dr. KING. Okay. 

Mr. BECERRA. If we were to go toward a system to try to incent 
the institution of a HIT throughout the country, and certainly in 
your clinic — and while you have moved forward, chances are if 
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we’re doing it through Medicare, you’re going to get very little 
money back. 

Dr. KING. That is correct, because we don’t have a lot of Medi- 
care patients. 

Mr. BECERRA. But you do have a lot of Medicaid patients. 

Dr. KING. Yes. 

Mr. BECERRA. Do you get any SCHIP patients? 

Dr. KING. We get some of those, as well. 

Mr. BECERRA. Okay. Do you get any other form of government- 
subsidized payment for patients that you see? 

Dr. KING. Off the top of my head — you’re talking about Federal? 

Mr. BECERRA. Or state. 

Dr. KING. We get tobacco tax. 

Mr. BECERRA. Okay. 

Dr. KING. There is some, like, special programs, like well women 
programs and 

Mr. BECERRA. Well, there 

Dr. KING. We also have WIC. 

Mr. BECERRA. There are programs sponsored, supported, sub- 
sidized by the government — Federal, state, and maybe local — that 
offer you some reimbursement for some of the patients which you 
see, because most of the folks you see, obviously, are modest in- 
come or uninsured. 

Dr. KING. Absolutely. We have 50 percent uninsured. 

Mr. BECERRA. Okay. 

Dr. KING. For every dollar that we get for uninsured patients, 
we spend about $2 on them. So, we do that by leveraging the 
money we get from Medicaid, primarily. 

Mr. BECERRA. Your clinic is like thousands of clinics through- 
out the country who provide care to some 16 million people in 
America who otherwise might not have access to good health care. 
So we thank you for that. 

My question, then, is if we go toward a model that only seeks to 
use Medicare to try to provide the incentive for health IT, is that 
going to help the community clinic universe that’s out there, pro- 
viding care to some 16 million Americans? 

Dr. KING. It would leave us out. 

Mr. BECERRA. It would? Do you think there is any reason why 
we couldn’t use Medicaid as a mechanism to try to offer incentives 
to adopt HIT? 

Dr. KING. No, Sir. I think that’s 

Mr. BECERRA. Can you think of any reason why we wouldn’t 
want to consider using the SCHIP program to perhaps also adopt 

HIT? 

Dr. KING. Perhaps it doesn’t penetrate deep enough. That would 
be my only concern. 

Mr. BECERRA. But we are providing it to some six million to 
seven million kids right now. 

Dr. KING. Right. 

Mr. BECERRA. If Congress is successful in overriding the Presi- 
dent’s veto, we would include another five million kids from mod- 
est-income families. So, that might be another mechanism? 

Dr. KING. Makes sense, yes. 
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Mr. BECERRA. Okay. Dr. Orszag, is there any reason that 
you’re aware of why Medicaid or SCHIP could not also be consid- 
ered vehicles through which we would try to incent, positively or 
negatively, the adoption of HIT? 

Dr. ORSZAG. No, I can’t think of a reason. Indeed, it’s not just 
community clinics, but also pediatricians and other parts of the 
medical system that would be left out in a Medicare-only approach. 

Mr. BECERRA. You forecast my question to Dr. Ejnes, and that 
is, is there any reason, Dr. Ejnes, that you think that we should 
not consider using SCHIP or Medicaid, as well as Medicare, for po- 
tential vehicles to try to incent the adoption of HIT? 

Dr. EJNES. No, I can’t think of any reason. I think all payers 
have a stake in this. 

Mr. BECERRA. Okay, good. Dr. Orszag, do you have a sense — 
and this may go beyond what you have examined — but do you have 
a sense of how much an incentive, positive or negative, and over 
what timeframe we would have to do this, in order to try to really 
capture the providers out there in America into this system of HIT? 

Mr. ORSZAG. Well, I guess that’s similar to a question — it de- 
pends on how deep an incentive you want to provide. It’s similar 
to the question of how much it would cost to move towards uni- 
versal health IT. The answer is, it depends on the systems adopted, 
but something in the range of tens of billions of dollars. In your 
head, if you want something, you know, $50 billion to $70 billion 
or so is the kind of number that you should have in your head. 

You obviously don’t need to pay — you don’t need to fully sub- 
sidize that, if you don’t want to, but that is the kind of range that 
one might want to have in your mind, if you are thinking about the 
total cost. 

By the way, that — just coming back to the earlier question — 
that’s for adoption, and then there are ongoing maintenance and 
other costs. 

Mr. BECERRA. I appreciate that. Thank you, Mr. Chairman. I 
yield back the balance of my time. 

Chairman STARK. Thank you. Let’s see, who — Mr. Emanuel, 
would you like to inquire? 

Mr. EMANUEL. Thank you, Mr. Chairman. Dr. Orszag, if you 
look at IT, or look at your $700 billion of what you think are sav- 
ings through efficiency in otherwise spent dollars, you have the 
chronic illnesses, wellness programs — the other side of that chronic 
illnesses — you have paying doctors for outcomes, rather than fee- 
for-service, you have IT. 

Break down the parts — and I know this is a rough game — and 
I am a little confused, because some people are saying what you 
said, and then other people’s testimony is slightly different, that IT 
kind of is the foundation to all these others. Then, you are saying 
that IT is just a piece of those, and — you know, the others — and it’s 
just a composite. 

So, is IT the essential combination to the lock of the whole $700 
billion, or do you see it as just a part and parcel of other sets of 
pieces that would get us at that $700 billion? 

Mr. ORSZAG. It unlocks one of the locks, but there is then a bolt 
and other things on the door, so there are many other things that 
have to happen in order for 
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Mr. EMANUEL. Don’t ruin a bad metaphor of mine, okay? It was 
horrible when it started. Please, don’t do that. Go ahead. 

Mr. ORSZAG. Health IT — so the report says, and in terms of 
foundations, think of health IT as necessary but not sufficient. You 
need to do it in order to get the data to do comparative effective- 
ness research, and then to pay for what works. That is crucial, in- 
cluding for those needing chronic care and those with multiple 
chronic conditions. 

But by itself, if you just plop a health IT system into a frag- 
mented system with distorted incentives, don’t expect magic. You’re 
not going to get the $700 billion by just putting health IT in. 

Now, if you want to start breaking it down — the problem is, if 
we need to make three or four changes in order to capture that effi- 
ciency, and they’re all necessary, you can’t — I can’t give you a 
breakdown on how much is coming from this piece versus that 
piece. 

Mr. EMANUEL. Well, let me ask you this way. Tell me if this 
is right, that we spend about 60 percent of our dollars on chronic 
illness that, if those were managed better, you would see a reduc- 
tion of health care costs. 

Mr. ORSZAG. The majority 

Mr. EMANUEL. Close? 

Mr. ORSZAG. It depends exactly, but yes. The majority of health 
care costs are going towards very seriously sick people. By the way, 
that’s where a lot of this variation that is occurring across the 
United States is occurring, also. 

Mr. EMANUEL. Let me understand, because I think one of the 
problems when I looked at the report also is about how much Ger- 
many has spent, Great Britain has spent, versus what we spend on 
a per capita basis. We’re like in the pennies, and they’re spending 
$21 a patient, et cetera. 

We discussed this, Democrats on the Committee talking yester- 
day, on the IT space. You know, I noticed last time when we did 
a spectrum sale, we thought it would generate about $10 billion in 
revenue, and it generated $19 billion. Have you ever looked at 
using that type of revenue, of asset sales as — in a dedicated area 
that would go into a health IT? We can do it as a revolving fund, 
et cetera, as a way to leverage those dollars, but selling some type 
of asset to generate this — what you would call start-it-up capital 
for this specific space? 

If you were to do that, what would be the first type of payments 
you would do, given what you said, you know, medical IT has to 
be in combination with other things? 

Mr. ORSZAG. First, let me say on Federal assets, I think there 
is a substantial amount of Federal assets that could be better man- 
aged, and potentially sold in exchange for revenue that could be 
used for other things, and that — spectrum, by the way, if you move 
toward addressing climate change, you’re also creating a very valu- 
able commodity there. Federal properties and land and buildings, 
and what have you, there are all sorts of assets that we are not 
optimally managing, and that could be used for this sort of thing. 

I have not actually thought about what would be at the top of 
the list for this specific application, but the general thought, I 
think, is a very good one. 
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Mr. EMANUEL. All right, thank you. Mr. Chairman, I yield 
back. 

Chairman STARK. Thank you. Ms. Tubbs Jones, would you like 
to inquire? 

Ms. TUBBS JONES. Mr. Chairman, thank you. To the speakers, 
thank you for coming this morning. This is significant, that we are 
talking about IT as we transform the delivery of health care from 
people who used to walk up to a doctor’s door, and the doctor did 
everything that they needed to, large systems delivering health 
care. 

I want to commend my staff, Athena Abdullah, for a wonderful 
opening statement. It’s so good, that I am going to read a part of 
it before I ask you questions. 

The requisite tools and technologies are viable if a company — let 
me back up and start from this page. 

Our current care delivery model requires a myriad of Federal 
and state laws, and regulations that are difficult to understand and 
navigate for large payers and providers. Vulnerable and under- 
served populations rarely have the resources or tools to effectively 
understand and navigate the mix of Federal, state, and local enti- 
ties engaged in providing their health care. The requisite tools and 
technologies are viable if a company by culturally, linguistically, 
appropriate outreach and educational initiative, advocacy and pub- 
lic policy strategies, work force development and training ventures, 
and concrete options for funding and sustainability. 

A comprehensive approach will be required to bring under-served 
populations into our National HIT framework to achieve improved 
health quality and access for racial and ethnic minorities, and 
other under-served and vulnerable populations. 

Health information technology is widely viewed as a tool to im- 
prove health quality and expand health access for consumers in the 
United States. Public, private, and community stakeholders have a 
vested interest in insuring that all communities participate fully in 
the benefits of health information and related technologies. 

Just last evening, I held my first telephone townhall meeting 
with my constituents in the 11th congressional district of Ohio. 
What I found very interesting was the reception or receptivity of 
people to having access to that process. It made it a lot easier for 
seniors who may not get out of the house, who could do it by tele- 
phone, contact by telephone. 

But the dilemma I see, and the dilemma I see as we walk our 
way through this whole technology piece, is the need to be inclusive 
of those who historically are not accessing computers, technology, 
who are afraid to even think about getting on a computer. I would 
be curious to give each of you the three minutes that I probably 
have left at this point to answer for me, how do we bring into this 
world the people who are not into technology, who also are not nec- 
essarily into accessing improved health care? They want better 
health care, but they don’t always receive it. 

I am going to start with Mr. Jones, and I am going to come to 
Dr. Orszag, and anybody else can pipe in. Mr. Jones, I picked you 
because I think you can help me answer that question. Go ahead, 
Sir. 

Mr. JONES. Well, thank you. I think that a 
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Ms. TUBBS JONES. Also, we might be related, you know, so we 
might as well take 

[Laughter.] 

Mr. JONES. We may be. We may be. I think that the — a lot of 
what we’re talking about is the ability for those who would assist 
those under-represented populations to be technology-enabled. 

So, for example, in Philadelphia, where I live, there are several 
academic medical centers — University of Pennsylvania Hospital, 
Temple University Hospital System — who serve a lot of these who 
are disenfranchised. So, I have had talks with both of them — and 
I know that they have initiatives — in order to try to upgrade their 
IT capabilities, so that they can extend the benefit of that to the 
populations they serve, whether it’s through their hospitals or their 
physicians, who are affiliated with the hospitals. 

So, I think that is one way. If we can go to urban centers and 
other places where these populations are and empowered, the pro- 
viders, to be able to access this technology, it would be helpful. 

Mr. ORSZAG. Yes, if I could just add, I mean, this is related to 
the discussion we were having earlier about community clinics and 
other providers that are serving, disproportionately, those popu- 
lations. 

But let me back up and say I think an absolutely huge issue that 
has received far too little attention — we have heard a lot about in- 
equality in income; we have heard far too little about inequality in 
life expectancy and other health outcomes. Life expectancy inequal- 
ity in the United States is exploding by income. 

So, at the top of the socio-economic distribution, life expectancy 
is going up much faster. At the bottom, it is either flat, or perhaps 
even declining. I think this is a major issue that has received very 
little attention. 

Ms. TUBBS JONES. I appreciate your response. Mr. Chairman, 
my time has ended. But I would hope that, at some point, we 
could — he is not paying attention to me, so I’m going to keep talk- 
ing. No, I hope that we have an opportunity to further explore that 
very issue. 

You will remember back — President Bush said to people of color, 
“I am going to help you get Social Security, because you die early.” 
We kept saying, “Don’t tell us — help us get Social Security, stop — 
help us not die early, you know, stop us — the death decline of mi- 
nority populations.” So, I thank you for your 

Mr. ORSZAG. Well, while the Chairman is distracted, maybe we 
should say there should be a hearing on the topic, or 

Ms. TUBBS JONES. I think there should be a hearing. All in 
favor, say 

[Laughter.] 

Chairman STARK. We had a hearing in June. 

Mr. KIND. You just lost control of the Committee. 

Chairman STARK. I think so, yes. 

Ms. TUBBS JONES. I yield back the balance of my time. 

Chairman STARK. Yes, your time just expired. 

[Laughter.] 

Chairman STARK. Mr. Kind, would you 

Mr. KIND. Thank you, Mr. Chairman. I want to thank our panel 
of witnesses today. I think this is an incredibly important topic, 
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and we really do need to wade into the weeds a little bit more on 
this. 

The reason I think it’s important is I think it’s imperative that 
we do strive to reach a both public and private reimbursement sys- 
tem, based on outcomes in performance, value of care, health care. 
The only way we’re going to be able to do that is if we can establish 
the standards of what that outcome in performance should be. The 
only way we can do that is collect the comparative analysis and the 
data. The only way we can get there is with an effective, fully 
interoperable HIT system, one that deals with the privacy and the 
security issues and that, but one that is completely interoperable. 

Now, the details get difficult and tricky, and that’s where you all 
are supposed to be helping us with type of incentives, disincentives 
that we can create in order to get this build-out and this infrastruc- 
ture done sooner, rather than later. 

I am proud to hail from a state that seems to be at the forefront 
of this movement in Wisconsin, with their quality health care col- 
laborative initiative that they have, where all the providers have 
voluntarily agreed to come together to develop the comparative 
standards of care that we should be striving for. It is unfortunate 
that Mr. Reding wasn’t able to make it here from Marshfield Clin- 
ic, because they have been doing some very interesting and exciting 
cutting edge things involving all this. 

But, Dr. Orszag, let me start with you. We hear this $700 billion 
figure mentioned about potential savings in the Medicare system. 
Now, is that assuming that we get to this outcome, or performance- 
based reimbursement system with HIT in there and all these dif- 
ficulties that have been discussed today resolved? Or does that in- 
volve other factors? 

Mr. ORSZAG. Two things. First, that’s for overall health spend- 
ing, it’s not just Medicare. Second, it is in — it’s kind of scoping out 
what the potential is, and it would require the type of health IT 
system that we were discussing, it would require an aggressive 
comparative effectiveness research effort, it would require a sub- 
stantial change in payment methodology, but under Medicare and 
the rest of the health system, in order to capture even a significant 
portion of it, and there would be lots of sort of political economy 
difficulties in doing that. 

It is intended just to say, “What’s the potential,” while recog- 
nizing the massive constraints we face in trying to capture that. 

Mr. KIND. My sense, too — as you said, 15 to 20 percent are al- 
ready doing it, they’ve already made the investment and gone to 
HIT, you know, the various systems out there — but my sense is 
that this is also a generational thing. You’ve got some older practi- 
tioners out there that might be a little more loathe to make the 
conversation. 

My sense, too, is it’s kind of a difference between established hos- 
pitals with huge paper records already in existence, versus newer 
provider networks that are just getting up and going, and are will- 
ing to make that initial up-front investment. 

But one of the areas — and I want to kind of wade into some sen- 
sitive area here, too — is we all realize there are substantial costs, 
as far as end-of-life care. I am just wondering what difference a 
performance or outcomes-based standardized system would make, 
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when it comes to medical decisions involving the final 6 weeks or 
6 months of life, because it seems inherently subjective and so 
much depends on the attitude of the consumer, the patient, at that 
point, what their expectations of care really are. 

I think one of the problems that we have in health care is we’re 
not listening to the patients well enough when it comes to end-of- 
life care. Because I think, if we did, there would be an inherent 
more conservative attitude from most folks that what they really 
want is a chance to be at home, surrounded by their family and 
loved ones with pain medication to deal with it, but a chance to be 
in that type of setting, as opposed to multiple tests and prolonged 
ICU stays, and things of that nature. We really haven’t touched 
about end-of-life care, and it is a big chunk of what we’re dealing 
with here. 

Mr. ORSZAG. Let me come back and say, again, if you look at 
the last six months of life, even at our leading medical centers, you 
see dramatic differences in the intensity of services, how many of 
those tests are being done, how many specialists you’re seeing and 
what have you, which to me suggests, I mean, even at those places 
where, basically, the best medical care in the world is delivered, we 
are delivering it in different ways across different parts of the 
United States, and we don’t know what we’re getting in exchange 
for the more intense approaches. 

Health IT and comparative effectiveness — the things we are dis- 
cussing, would let you drill down in why — what are we getting, in 
exchange for that additional test, that additional procedure, that 
additional day in the hospital, which we can’t answer now, and 
which many people express a lot of skepticism, in terms of whether 
there is any additional benefit. 

I would also say there is evidence suggesting that when people 
are confronted with the types of choices that you are discussing, 
they do often choose the less expensive, less intensive approach. 

Mr. KIND. All right. Thank you. Thank you, Mr. Chairman. I ap- 
preciate the hearing today. 

Chairman STARK. Thank you. Ms. Schwartz, would you like to 
inquire? 

Ms. SCHWARTZ. Thank you very much, Mr. Chairman. Again, 
thank you for your courtesy that you have extended to me. I really 
appreciate it, as — I don’t know what to call myself — an adjunct vis- 
itor here. 

But I wanted to — I think that I am here because I am very keen- 
ly interested in health IT, and some of you certainly know that we 
had, I thought, a very significant victory last week, with including 
e-prescribing — I pushed pretty hard for that — in the Medicare bill, 
with tremendous support, of course, from the Committee chair and 
the Committee, more broadly. 

I have actually seen a great deal of interest expressed to me 
about the fact that we did get e-prescribing done. I think almost — 
now there are other members coming to me and saying, “Wow, I 
think we just did something really important, and we ought to do 
more of it.” 

So, I think it’s creating an enormous opportunity for us to pro- 
ceed with incentivizing. As you know, under e-prescribing, we used 
both carrots and sticks, as Dr. Orszag pointed out, to use that 



119 


model, moving forward. Now, of course, this is much more complex, 
to use electronic medical records more broadly. You raised a lot of 
the issues we have to deal with. 

As I understand it — and there are many places for me to go, ac- 
tually, in terms of my questions, but I wondered if you could give 
us some help on one aspect that we understand, which is just mov- 
ing from paper to electronic records is simply not good enough. It 
might make it easier, but it isn’t going to achieve the savings or 
the improved quality, unless it’s really a comprehensive medical 
record, and it really changes behavior by the providers, and hope- 
fully by the patients, as well. 

We are looking at protocols, you know, different kinds of informa- 
tion that might be available not only between providers, but even 
for an individual medical practice or an individual provider. 

So, instead of my giving the list of possibilities of evidence-based 
clinical protocols and things that might be added to this, could you 
better define what kind of conditions, or could we articulate what 
we would say if we were going to provide incentives for use of elec- 
tronic medical records, what conditions, what the definition of 
those electronic medical records would contain? 

You know, what would the expectation be that, again, this isn’t 
just going to — going from paper to electronics, but what kinds of ac- 
tions, what kinds of conditions, in addition to the privacy ones, in 
terms of patient practice, I think is — you know, I mean physician 
practice and hospital practice — that we might want to outline, de- 
fine? Do you think we could do that? 

We haven’t heard much of anything — start with you. 

Dr. EJNES. Yes, I think, you know, you’re absolutely correct. 
Just going to collection of word processing documents that are leg- 
ible is not an electronic record that is going to make a difference. 

But certainly you spent a lot of time discussing what we refer to 
as decision support. That is something that we think a full-bodied 
EHR should have: decision support in terms of providing guidance 
on how to treat a condition; what types of evidence there are; re- 
minders on monitoring, if someone is on a certain medication, what 
needs to be checked; the ability to check allergies, look at drug 
interactions; the ability to keep track of patients, the registry func- 
tions, if you will, so that, you know, we can get reports on how 
we’re doing with our diabetics in the practice, or our hypertensives; 
and the interoperability, the ability to capture the information that 
the other doctors taking care of the patients can provide. 

So, I think you are correct. The EHR has to be able to do more 
than just digitize what’s in the charts in the record room. 

Ms. SCHWARTZ. Two quick questions to follow up on this one. 
Is — do you think those are well defined enough for us to be able 
to articulate them and require them? 

Do you think that we can create a system — and do you have sug- 
gestions for how to make sure that that is dynamic enough so that 
we don’t set it in place? 

We always have to be concerned about that here, that we set it 
in place so that it doesn’t — it’s got to change very frequently, it’s 
got to be very dynamic, in order to — medical science changes all the 
time. You want to be able to say, “Okay, it wasn’t last year’s pro- 
tocol. We want it to be today’s protocol,” and we have to make sure 
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that that’s dynamic. Would you suggest how we actually make sure 
that happens? 

Dr. EJNES. Yes, I think we can define what it is. In fact, a lot 
of the surveys that look at EHR uptake distinguish the full-fledged 
ones from the others. I think the certification commission has 
played a major role in defining the various functionalities that an 
EHR should have. So, I think we’re on our way there. 

Ms. SCHWARTZ. Maybe Dr. Orszag wants to answer this if any- 
one else does — so how much savings could we reap, if we actually 
do do it right? I do understand that that is a big question. But, as- 
suming we do do it right, we want to incentivize this behavior, I 
am willing to see a stick at the end of the day. 

How long will it take — maybe this is a question for anyone else, 
too — but how long will it take for us to reap a significant return 
on our investment and savings in the system? 

Mr. ORSZAG. I think, again, it comes down to what do you mean 
by “doing it right.” If doing it right means just health IT, I 

Ms. SCHWARTZ. No, no, no. I have already expressed the fact 
that this is 

Mr. ORSZAG. You’ve got the whole thing. Okay. 

Ms. SCHWARTZ. Right. 

Mr. ORSZAG. You’ve got the whole package. You are doing 

Ms. SCHWARTZ. It is interoperable, it has protocols that we’re 
going to define quality, we’re going to 

Mr. ORSZAG. Yes, but I am also going to layer on you’re doing 
an aggressive comparative effectiveness effort, so that 

Ms. SCHWARTZ. Okay. 

Mr. ORSZAG [continuing]. You are using the data that are com- 
ing out of that, and then you are actually then tying financial in- 
centives for providers to the evidence that is coming out of that, de- 
spite all of the backlash that would then ensue. 

Ms. SCHWARTZ. Right. 

Mr. ORSZAG. You do all of that, and you do it very aggressively, 
I think that is the best hope for capturing a large share of that 
$700 billion. I can’t quantify exactly how much, but it is — the more 
aggressive you do it, the more likely it is you’re going to capture 
more of that efficiency. 

Ms. SCHWARTZ. Okay. Thank you, Mr. Chairman. 

Chairman STARK. Thank you. Mr. McDermott, would you like to 
inquire? 

Dr. MCDERMOTT. Thank you, Mr. Chairman. I would like to 
follow a little bit of the Chairman’s line of questioning, because a 
couple of people reacted negatively to one of his suggestions — that 
is, that we have one system, or can we get it down to one system. 

When I was a medical student, I did research. You could find 2 
left-handed plumbers living in a town of under 40,000 people in the 
Danish health records with no problem at all, and you still can’t 
do that in the United States. 

So, it strikes me that before we spend a time on incentives, there 
has to be a set of standards that are acceptable — the government 
puts out 65 percent of the health care money in this country al- 
ready, with Medicare and Medicaid and Indian health and veterans 
health, and the DoD. So, we should set a standard at the Federal 
level. I will tell you why I feel this way. 
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I spent 5 years trying to get the veterans system and the Depart- 
ment of Defense to talk to each other. Much of that Veterans Ad- 
ministration stuff was done in Seattle. I have seen doctors sit there 
with two screens — one, the VA screen, and one, the DoD screen — 
some guy in Iraq comes back all beat up. He is discharged from the 
military. He goes into the Veterans’ system. His military records 
are still at DoD. The two systems won’t talk to each other. 

I talked to admirals and generals and everybody up and down 
the medical line, and what I found was that there was a propri- 
etary system developed by the military. God knows we can’t touch 
a proprietary system. When we have this VA system which is a 
much better system, much more applicable, much more widely — it’s 
now used in hospitals in Seattle, where people from the community 
can check into the Veterans’ system if a veteran appears at the 
Swedish hospital, or at the university hospital, or whatever. 

I reacted when I heard a couple of you — I think it was one of the 
doctors said, “We don’t want a single standard.” I understand that 
the free enterprise system wants to let a thousand flowers bloom. 
But explain to me how is a physician — if the point of the system 
is research, that is, we can compare across the country, and it is 
to give better health care, that is, since your patient appears in my 
hospital I can go in and find the information, why you wouldn’t 
want one interactive system that would be — I mean, I have the 
problem with two computers, one in here in Washington, DC, and 
one in Seattle, and they can’t seem to get the same thing on the 
screen when I open it up. 

Dr. EJNES. Yes, yes. Just so that I am — you know, we’re clear, 
this is — it’s confusing, because we talk about system. I think I mis- 
understood the Chairman’s question, initially. I thought he was 
asking about the software application that sits on the physician’s 
desk. 

I mean, I think we are all in agreement that there should be a 
system, there should be a common language that allows the infor- 
mation to be exchanged. My point was that, given that every physi- 
cian’s office differs in one way, shape, or form from another, to re- 
quire a single software program that would be the EMR for all phy- 
sicians would not be successful, because the needs of a large 50- 
physician group are different from those of a 2-physician group. 

But in terms of the ability to take whatever sits on that desktop 
in that office, and exchange the information in the way that you 
describe, I think we’re all on the same page, and we do support 
standards, we do support a system of health information exchange 
that allows different entities with different systems — either propri- 
etary or open source — to exchange patient information. But when 
you get down to the institution level, to the practice level, there 
may be specific needs that may not be met by a one-size-fits-all ap- 
plication. 

Dr. MCDERMOTT. But then — and here is the problem, it seems 
to me. We pass an incentive out of here, we put billions of dollars 
out there and we say, “Okay, guys, everybody in the medical pro- 
fession should now be a part of the system,” and they all plug into 
what? 
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What is incentivizing them to become a part of? Just to have 
hand-held devices, or are we a system, or what? What is it we’re 
incentivizing? I would like to hear what 

Mr. WHITLINGER. Perhaps the analogy could come from the fi- 
nancial sector. I mean, there are hundreds 

Dr. MCDERMOTT. No, this is medicine. Talk about how it works 
in a hospital. 

Mr. WHITLINGER. But if you think of the banking center, 
where there are thousands of banks, and each of those banks has 
its own data center and its own ability to store its data, keep it pri- 
vate, keep it secure, and give its own members the quality and the 
services of banking that they would like to provide, yet all those 
banks are interoperable, all those banks can exchange data, with 
regards to funds. 

Dr. MCDERMOTT. So, is it 

Mr. WHITLINGER. Perhaps that is the analogy 

Dr. MCDERMOTT. The reason you need the different systems is 
because you want to protect the privacy of patients? Is that what 
you’re talking about? 

Mr. WHITLINGER. Well, you could 

Dr. MCDERMOTT. Why not have a system that I, as a doctor, 
could get in and read? 

Mr. WHITLINGER. So, you could look at it from a couple of dif- 
ferent perspectives. But one is that, perhaps, different medical 
practices would be offering different services. Another is that they 
could be competitive by offering different services of a data nature, 
as well. 

Now, the fact that they can interoperate allows the system that 
we would all like to have, where you have transportability and 
importability of the data and the patients 

Dr. KING. My feeling is that Vista was paid for by taxpayers, 
and it should be available to taxpayers. It is a great system that 
evidence in the literature has literally hundreds of citations to sup- 
port how good that it operates. It’s the most interoperable system 
that exists in the United States right now, between specialists and 
everyone in the VA. 

I think my personal feeling is that if we were going to sit down 
and design a system, we wouldn’t be having — a health care sys- 
tem — if we started from scratch with a blank piece of paper, we 
wouldn’t be asking this question. We would have one system, be- 
cause that’s what makes sense. The reason we are asking the ques- 
tion is because nobody designed the health care system, and it is 
a mess. 

I personally believe we should have one system, and we should 
have competition at the vendor level. That would keep the health 
care costs in the health information technology arena down, be- 
cause then you would have vendors that are competing against 
each other. Once you go proprietary, then you have to keep with 
what their support costs are, and you’re locked in. 

Dr. MCDERMOTT. So, you’re saying you want something like 
what’s happened with the tanker issue in the Air Force. You want 
to have two vendors compete for who can build the best tanker. Is 
that the 
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Dr. KING. I’m not really familiar with that. I am not sure that’s 
what I am advocating. 

Dr. MCDERMOTT. Who could pay off the auditors, is what I 

Dr. KING. Did the tankers sink? 

[Laughter.] 

Dr. MCDERMOTT. The problem with that is that — I was a state 
legislator, and I bought the first computers for the Department of 
Health and Human Services in the state of Washington. I spent 
millions of dollars on them, and we threw out system after system 
after system that one vendor came in and sold us, and that one 
didn’t work, or they couldn’t make it work, so we threw out a — we 
came — I don’t know how much money we have wasted in this coun- 
try on buying systems. 

I want something like Vista to 

Dr. KING. Right. But if you have one system, then what you can 
have is many vendors supporting that system. So, then you have 
the competition at the vendor level, instead of at the system level. 
I think that could save a lot of costs. 

Mr. JONES. If I might point out, though, there are multiple 
kinds of systems that are involved. So, electronic health record is 
one thing that you may use in a physician office, but it needs to 
get information from a lab information system that a reference lab 
uses. 

There is also a hospital information system which is different 
than an electronic health record system. There are systems that 
hold images. So, all of these different kinds of systems need to 
speak with one another. So, specifying one electronic health record 
system is sort of the camel’s nose in a tent, because then you have 
to specify one lab information system, and one — you know, you ulti- 
mately would have to specify everything not only that exists, but 
that could be imagined. 

So, we would have to — it is better to say, “Let’s specify the way 
that they would speak to each other,” and mandate whoever has 
a system does it that way. 

Ms. MCGRAW. One of the — I know we’re over, but one of the 
things that nobody has mentioned yet is the certification commis- 
sion for health IT. The standards bodies that have been — the 
standards body that Lee has referenced, again, they are bringing 
the stakeholders together to come to agreement on what the com- 
mon standards should be, so that these systems — which may them- 
selves, in the software, have differences — at the level of creating a 
national health IT network will be able to talk to one another. 

The certification commission, which is a contractor to the Federal 
Government, is being paid to come up with standards for certifying 
products that meet those standards, so that people buying the sys- 
tem that meets the CCHIT criteria know that they have bought a 
system that has the standards that essentially have been adopted 
or endorsed through this process. So, 

Chairman STARK. Would you yield? 

Ms. MCGRAW. Yes, Sir. 

Chairman STARK. I am informed that they are certifying sys- 
tems that can’t talk to each other. 

Ms. MCGRAW. Well, that would be quite unfortunate. I 

Chairman STARK. That’s my understanding of 
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Ms. MCGRAW. But I think it is worth looking into, so that we 
get some clear information here. 

Chairman STARK. Yes. Yes, it is. 

Ms. MCGRAW. Because, from a consumer standpoint, I do worry 
about blessing one system that everyone has to buy, from a sort of 
innovation standpoint. Stifling that 

Chairman STARK. What about if it’s one system that we give 
them free? 

Ms. MCGRAW. Well, somebody has got to pay for that. 

Chairman STARK. We already have, haven’t we, Dr. Pete? It’s 
Vista. We can continue this informally, if we like. We can give our 
clerk a reprieve and call the formal session to an end. Hopefully, 
some of you would like to stay and discuss this. 

Thank you. I want to thank the panel. Thank you very much, Dr. 
Orszag, who normally would go off first by himself and get out of 
here a lot sooner, thanks for sticking around, Peter, and thank you 
all for taking the time. It has been very helpful. 

We are going to call you back. I know we’re going to need more 
information. Be well. 

[Whereupon, at 12:10 p.m., the hearing was adjourned.] 

[Questions for the Record follow:] 
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Douglas J. Reding, MD, MPH, FACP 
Oncologist/Hematologist 
Vice President, Marshfield Clinic 
1 000 North Oak Ave 
Marshfield, WI 54449-5777 

Dear Dr. Reding: 

As a follow up to the Health Subcommittee hearing on promoting the adoption and use of 
health information technology on July, 24 ,h 2008; please respond to the following 
questions for the record. 

Questions from Ranking Member Camp: 

1 . 1 understand that you have had a chance to review the health IT bill I introduced 
last month. 

Are there provisions in my bill that you believe should become law? 

2. 1 understand that the Marshfield Clinic is just one of many hospital, clinic, and 
physician groups that have expressed their concerns about the privacy language in 
H.R.6357. 

What impact do you feel this language would have on your clinic’s ability to 
implement care and quality improvement programs as well as to monitor and 
prevent fraud? 

3. Do you feel the current H1PAA protections sufficiently guard patient privacy as it 
relates to electronic records? 

What steps does the Marshfield Clinic take to ensure that information found 
patient’s electronic records are kept private and used appropriately? 

How does the Marshfield Clinic deal with employees who improperly access 
medical records? 
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Hearing Clerk 

Committee on Ways and Means 
United States House of Representatives 
Washington, DC 20515 

Dear Ms. Breidenbach: 


On behalf of the Executive Committee and the Board of Directors of Marshfield Clinic, I am writing to 
respond to questions from Ranking Member Camp in follow-up to the hearing on promoting the adoption 
and use of health technology, which took place on July 24, 2008. 


We appreciate the opportunity to provide our testimony and the following responses to the questions 
posed by Representative Camp. 


Sincerely, 



' DOUGLAS J. REDING, M.D. 
Vice President, Marshfield Clinic 
Chairperson Government Relations 
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1. I understand that you have had a chance to review the health IT bill I introduced last 
month. Are there provisions in my bill that you believe should become law? 

We have reviewed legislation introduced by Rep. Camp, HR 6179. There are several provisions of this 
legislation that we believe are Important: 

Section 101 would codify the Office of the National Coordinator for Health Information Technology, we believe 
this is essential to maintain the continuity of operations begun by Dr. David Brailer and now directed by Dr. 
Robert Kolodner. In particular, as a vendor of CattailsMD, the CCHIT certified proprietary electronic medical 
record developed by Marshfield Oinlc, we believe that certification is an essential guarantee in an uncertain 
market that electronic medical records can be relied upon by providers and their patients. 

Section 302 eliminates the Sunset applicable to the Stark exception for electronic health records. As we noted In 
our testimony submitted for the record, Marshfield Clinic is very dosefy associated with the Ministry Health 
System as well as other providers serving patients in our service areas. The exception provides some comfort 
to providers who are wary of any implication of improper referral influences. 

Section 303 promotes the expansion of telehealth services. Marshfield Clinic is one of the largest telehealth 
providers in the country, serving a largely rural population with needs that stretch across state borders. We 
appredate the reciprodty provisions and the expansion of telehealth sites of origin, which have been shown to 
add very minimal expense, and substantially improved access. 

Finally, in Section 304 HR 6179 establishes an electronic health demonstration in Federally Qualified Health 
Centers. Marshfield Clinic is the sponsor of an FQHC known as the Family Health Center in Marshfield, which is 
nationally distinguished because it provides dental services to the indigent throughout the State of Wisconsin 
and incorporates periodontal records with the Marshfield Clinic electronic medical record. FQHCs should be 
supported because they bring us one step closer to the universal health coverage that we believe is necessary, 
at a reasonable cost. 

2. I understand that the Marshfield Clinic is just one of many hospital, clinic, and 
physician groups that have expressed their concerns about the privacy language in H.R. 6357. 
What impact do you feel this language would have on your clinic's ability to implement care and 
quality improvement programs as well as to monitor and prevent fraud? 

We are concerned that HR 6357, the "Protecting Records, Optimizing Treatment and Easing Communications 
through Health Care Technology Act of 2008" will increase the costs of providing health care and the cost of 
implementing electronic medical records without any measurement of the problem it is trying to solve. 

Provisions of HR 6357 may interfere with activities defined as "operations" under HIPAA that are essential to 
effective care management. 

As we stated in our testimony, to improve quality performance, the Oinlc developed software systems to care 
for chronically ill patients, to identify improvement opportunities, collect needed Information at the point of care, 
and report performance back to physicians. 

For example, our PreServ (Preventive Services) System is able to alert physicians when preventative services 
are due for a patient during a visit with a primary care manager. 

Our EMR also includes a system for flagging high-priority patients. A "hierarchical defect recovery list," which 
acts as a safety net, includes high-risk patients with multiple chronic conditions that are in need of immediate 
attention. 

We have also implemented an anticoagulation care management system for patients on Warfarin. 

The Clinic has also implemented electronic prescribing to enhance safety. 
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We have implemented a 24-hour nurse line, with an automated e-mail system that notifies physicians whose 
patients have called. 

We have developed a software tool called ‘iList* (Intervention List), which is used in primary care. IList 
generates a list of patients who have one of three chronic illnesses - diabetes, heart failure or hypertension - 
and who do not meet all of their recommended health goals. 

The PROTECHT Act requires covered entities to make a reasonable effort to restrict the use, disclosure, or 
request of PHI to a ’ limited data seC of information as defined in regulation. The PROTECHT Act also includes 
a new consent provision that requires additional patient consent if the PHI is utilized in operations, such as peer 
review, quality review, standard of care review, malpractice review, or best practices analysis. We believe that 
most of our care management processes fall within the definition of the term operations. These activities are 
the substance of care management, and interference with them interferes with the practice of evidence-based 
medicine. 

In addition, requiring an accounting of disclosures for all disclosures of PHI, including for treatment, payment, 
and healthcare operations will be difficult These disclosures are not logged or accounted for - as the law does 
not currently require this. A requirement to log all these disclosures could add 10 - 30% to the cost of 
implementing a robust EMR. 

How these provisions relate to our effort to prevent fraud. 

The Marshfield Clinic electronic medical record includes features that enable us to require authentication for 
electronic signature of documents and prescriptions. We also use our electronic medical records to facility chart 
review for coding and other compliance issues. 

The electronic medical record includes information about all of the treatments, procedures, diagnostics and 
therapies provided to any patient At Marshfield Clinic we utilize the record to assure that patients receive the 
care that they need when they need it. CMS has shown that this pattern of practice may lead to improved 
quality of care and substantial savings for the Medicare program. 

We refer you to the most recent results of the Physician Group Practice Demonstration, released by CMS August 
14, 2008. As a result of improved quality and efficiency made possible through the use of our HIT system in 
this demonstration Marshfield Clinic wil receive a payment from CMS of $5.78 million as a result of saving the 
Medicare Trust Funds $7,226,966 as measured by CMS, under the terms and conditions of the project. 

Just as the EMR can be a tool for increasing efficiency, it might also serve as a tool for identifying inefficiencies 
or intentional over-utilization of services. The EMR also has the potential to serve as an audit tool that could 
throw light on the diminishing utility of unnecessary, redundant or equivocal services. The problem that 
Congress must grapple with is that these features of an efficient HIT system may scare some providers away 
from implementing HIT operational care infrastructure that could retain evidence of wrongdoing. HR 6357 
doesn't solve this problem - it makes it less likety that providers could perform operations related to their 
treatment of patients that would leave an audit trail. We believe that the audit trail and the resulting 
accountability are in the public interest. 

3. Do you feel the current HIPAA protections sufficiently guard patient privacy as it relates 
to electronic records? 

Congress will have to decide where it places its priority. HIPAA is not a perfect law, but it does protect patient 
privacy. We might also add that electronic medical records are far more secure than paper records or any other 
alternative. Individual privacy, however, has been utterly compromised because marketing organizations now 
have many sophisticated tools to track consumer behavior. This information is valuable for marketing goods 
and services to targeted individuals and populations. To address and deter this invasion into the privacy of 
individuals, we recommend that congress strengthen enforcement of privacy violations. 

What steps does the Marshfield Clinic take to ensure that information found patient's 
electronic records are kept private and used appropriately? 

Marshfield Clinic has put in place the position of Data Security Officer. This is a general manager high-level 
position reporting directly to the Chief Information Officer of the corporation. 
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Marshfield Clinic audits all transmissions. For all access we know who accessed data, when and from what 
device. These audit files are kept indefinitely and can be scrutinized either for random check or for specific 
cause. 

Access to the electronic health record is established within a role-based hierarchy. All employees are assigned a 
role. Based on the role the employee is only granted access to information necessary to complete their job's 
functions. 

All information is maintained centrally. Information is only delivered to the workstation as a transient “screen 
shot". No patient data is ever stored remotely on the user workstations. 

Education on the importance of security and confidentiality is continuous. Ail employees are required to 
annually sign a corporate confidentiality agreement as a term for continuing employment. 

The following features complement the security of the Marshfield Clinic EMR: 

• Required complexity standards for password authentication. 

• Assignment of a primary device, typically a tablet computer for the vast majority of users. 

• Security warning to users when they log into a device that Is different from the previous device they logged 
into. 

• Role-based security for access to applications. 

• Screen designs that avoid casual exposure to patient health data. 

• Device locking alter a maximum 15 minutes of inactivity on a portable device, and after a maximum of 30 
minutes on a tower workstation. 

• Document-level audit trails of all user accesses to medical records. 

• Review of users' accesses of medial documents for both cause and for sampling of selected users' accesses 
based on association profile with patients, e.g. co-workers, relatives, or neighbors. 

• Routine suppression of health protected on data warehouse reports. 

• End user access agreements Including our policy on patient privacy that must be reviewed and affirmed 
yearly. 

• Encrypted transmission of wireless data (AES 128 bit) 

• Encryption of down-time data base. 

• Minimal storage of patient information on end user devices. 

• Physical security of main computer rooms. 

• Restricted access of programmers to patient data. 

• Anti-tamper hardware features of tablet computers. 

• Secure disposal of printed reports. 

• All computers have centrally managed virus/malware protection per industry best practice standards. 


How does the Marshfield Clinic deal with employees who improperly access medical records? 

All suspected breeches are investigated by the corporate data security officer and a senior staff attorney from 
corporate legal services. Marshfield Clinic handles improper employee access through the Clinic's progressive 
discipline policy, which may include termination. Discipline appropriate for the investigated findings Is rendered. 
Flagrant and malicious breeches usually result In the termination of the offending employee. 
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[Submissions for the Record follow:] 

Alex Hill, Statement 

Clinical patient data is stored in a variety of electronic systems. These systems 
use a variety of programming languages and database systems to store and main- 
tain the patient data. These systems encompass a mix of proprietary systems from 
commercial vendors, open source systems and systems developed at taxpayer ex- 
pense by government agencies. However, combining data from different systems (a) 
to obtain a comprehensive view of an individual patient, or (b) to analyze large vol- 
umes of data for public health purposes, is a major IT problem. This problem is par- 
ticularly acute in U.S. Healthcare since the majority of computer systems used in 
U.S. hospitals are based on legacy technologies, the most prominent of which is 
MUMPS. This is particularly true in the case of the hospital networks of the Vet- 
erans Administration (VistA) and the DOD’s Military Health System (AHLTA/ 
CHCS). However, it is also true of the systems offered by most of the leading com- 
mercial vendors of hospital systems. 

The above problems are not unique to Healthcare. The same challenges are faced 
across all industry sectors whose systems are based on legacy technologies. Re- 
cently, an Israeli software company, CAV Systems Ltd, developed a set of solutions 
that address these challenges and the solutions are already being successfully de- 
ployed there. 

Since these solutions are not industry-specific, they can be equally well applied 
to the challenge of legacy data and software in the U.S. Healthcare Industry. The 
potential benefits include billions of dollars in savings and accelerated progress to- 
wards the goal of a fully interconnected health IT infrastructure years ahead of 
present estimates. 

The Problem of Legacy Systems and Data 

(1) MUMPS is used by ever 90% a majority of hospital EHR applications and in- 
formation systems in the U.S. 

1. What is MUMPS? 

It is a programming and database system developed 4 decades ago at Massachu- 
setts General Hospital. It was subsequently adopted by many in the Healthcare 
community but is also used in other industry sectors. 

2. The “pros” 

At the time that MUMPS was conceived, the prevailing computer hardware, soft- 
ware, and programming staff were oriented towards the needs and economics of 
business rather than the needs of clinicians. MUMPS addressed the needs and eco- 
nomics of the clinical side of hospitals — and did so successfully. 

3. The “cons” 

Computer Science has advanced considerably since MUMPS was conceived. Sev- 
eral of its features that were viewed at that time as powerful, productive and bene- 
ficial are today no longer viewed as “good practice” for designing and programming 
complex systems such as Healthcare. Indeed it is the use of these features that is 
the source of many of the challenges facing the U.S. Healthcare industry at the 
present time. That is why they are today viewed as “bad practice”. 

(2) Many hospital systems in use in the U.S. today are effectively “abandoned” 
either because the vendors have gone out of business or have been acquired by com- 
petitors whose interests are to “sunset” these legacy systems (because they are 
based on MUMPS) and push new expensive systems that many hospitals — particu- 
larly those serving rural and smaller communities — simply cannot afford. The result 
is that “patient data is trapped” inside these legacy systems and cannot be accessed 
in any convenient, timely and affordable manner by other clinicians outside of the 
legacy system. This negatively impacts patient care. 

(3) The cost of new Hospital Information Systems is staggering. 

The power of computers has grown by orders of magnitude during the past two 
decades and the relative cost has decreased. The sophistication and usability of soft- 
ware has likewise advanced enormously during the same period and the relative 
cost has decreased. 

One would therefore expect the cost of Hospital Systems would reflect these 
trends. However, with rare exceptions, the opposite has been the case. The costs of 
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upgrading hospital systems, including new EHR technology, are running into the 
tens of millions of dollars per hospital, and in some cases exceed a hundred million 
dollars. Most hospitals cannot make this kind of investment in their systems. 

(4) The short-to-medium term solution is a way to extract the data from these leg- 
acy systems at an affordable cost: 

1. M2R — Replicator (MUMPS to Relational): 

The concept is simple: migrate the data from a legacy Mumps database to a more 
modern relational database format ( Oracle is one example of such a database), such 
as Oracl e. The legacy application would continue to run and perform all of its tasks, 
while the data is now available in a usable database format. The process can be set 
up so that the data is automatically and continuously updated in the new relational 
database. Once in the relational database, then all kinds of tools can be used to sort, 
manage and analyze the data. This would be a way of extracting quality data for 
Medicaid/Medicare, for example. 

A detailed outline of this process was submitted by CAV Systems to TRICARE 
Management Activity in December 2007 in response to “Joint DOD-VA Inpatient 
EHR RFI: W81XWH-08-RFI-EHR”. 

(5) The medium-to-long term solution is converting the legacy systems — the pro- 
grams as well as the data — to prevailing technologies: 

1. JUMPS (Java from MUMPS). 

The concept is simple: create Java programs that are functionally identical to the 
MUMPS programs — and do so with a very high level of automated procedures and 
minimal manual intervention of IT professionals. 

A detailed outline of this alternative approach was submitted by CAV Systems 
Ltd to TRICARE Management Activity in December 2007 in response to “Joint 
DOD-VA Inpatient EHR RFI: W81XWH-08-RFI-EHR”. 

(6) The viability and effectiveness of the CAV Systems’ solutions has been dem- 
onstrated to work in the U.S. in one of the most intractable systems to work with — 
the Military Health System’s legacy CHCS system. 

1. Proof of Concept (PoC)Project 

The Department of Defense’s medical research arm, Telemedicine and Ad- 
vanced Technology Research Center (TATRC), U.S. Army Medical Research 
and Materiel Command, located at Fort Detrick, Maryland, recently funded a 
Proof-of-Concept (PoC) project to validate the JUMPS technology [note: the M2R — 
Replicator technology is a subset of JUMPS so the PoC project was effectively vali- 
dating both]. The Report of the results of the project was delivered to TATRC at 
the end of April 2008. Following are several quotes from the report: 

• “The JUMPS technology works as claimed by CAV Systems. The JUMPS 
technology is scalable and can handle very large M/Cache systems whose 
scope and complexity are similar to those of CHCS.” 

• “The JUMPS migration process itself is straightforward and the skills re- 
quired to effectively use JUMPS are easily acquired by IT professionals famil- 
iar with the M/Cache environment and the Java/Oracle environment.” 

• “ — JUMPS is the only technology and process presently known to both parties 
that offers an automated methodology for the delivery of functionally identical 
systems from M/Cache to Java/Oracle, and to do so in relatively short time- 
frames — months rather than years.” 

2. How can this new technology help VA/DoD interoperability/data-sharing 
issues? 

The most widely used database systems in today’s world in almost all industries 
and all geographies are Oracle (from Oracle Corporation) and SQLServer (from 
Microsoft) in the commercial proprietary area, and MySQL and PostgreSQL in the 
Open Source sector. 

CAV Systems’ solutions — M2R — Replicator and JUMPS — are designed to work 
with any of these databases. This enables data that is trapped in legacy MUMPS 
systems to be “set free” since the vast majority of modern software products are al- 
ready designed to be used with these leading databases. 

The Military Health System presently encompasses two different systems — 
AHLTA with Oracle as its database technology and CHCS with MUMPS (or its pro- 
prietary version named Cache from InterSystems Corporation) as its database tech- 
nology. 
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The Veterans Administration likewise encompasses two different systems — VistA 
with MUMPS (or Cache) as its database technology and MyHealtheVet with Oracle 
as its database technology. 

Through the use of CAV Systems’ solutions, all patient data will be in Oracle. 
This drastically simplifies the interoperability/data-sharing issues. 

3. How this can be used as a national model? 

The pilot project conducted by TATRC shows that these technologies can be used 
to extract the data locked into the CHCS systems as well as to migrate the entire 
program to a modern language, JAVA. This same model can be used for Mumps sys- 
tems across the country. A Successful implementation by VA and DoD of interoper- 
ability/data-sharing that combines legacy data (from MUMPS systems) with data 
from modern systems such as Oracle would demonstrate the capability to the med- 
ical community at large. It would demonstrate several factors, including the value 
to patients and doctors alike, short time frames to a functional data exchange, as 
well as the savings compared to alternative approaches. 

Since most commercial health information systems are still based on legacy 
MUMPS technology, the CAV Systems’ set of solutions can bring similar benefits 
to the non-government sector of the healthcare community. 

These technologies can save taxpayers billions of dollars and years of work in 
building the national health infrastructure network. 

CAV Systems Ltd is an independent software house with 3 decades of experience 
and expertise in MUMPS. The aggregate MUMPS experience of the professional 
staff exceeds 250 man-years. It also has extensive experience and expertise in bridg- 
ing the legacy world of MUMPS with the modern world of web-based systems and 
prevailing technologies such as Java and Relational Databases. 

CAV Systems Ltd is the only company offering an approach (“process”) and ac- 
companying technology that automates the migration of very large legacy MUMPS 
systems to functionally identical Java/Oracle systems that can be deployed on com- 
modity yet powerful platforms based on prevailing systems such as Linux — and can 
do so in highly compressed timeframes (i.e. months, not years). 


Beverly Miner, Statement 

My name is Beverly Miner, Vice President and Executive Director of the National 
E-Prescribing Patient Safety Initiative (NEPSI) for All scripts. All scripts is the 
leading provider of clinical software, connectivity and information solutions that 
physicians use to improve healthcare. The company’s unique solutions inform, con- 
nect and transform healthcare, delivering improved care at lower cost. More than 
40,000 physicians and thousands of other healthcare professionals in clinics, hos- 
pitals and extended care facilities nationwide utilize All scripts to automate every- 
day tasks such as writing prescriptions, documenting patient care, managing billing 
and scheduling, and safely discharging patients, as well as to obtain key information 
and connect with important stakeholders in the healthcare system. 

The Committee is considering a bill which could bring healthcare into the modern 
age by encouraging the broad adoption and use of health information technology. 
The electronic prescribing program in the recently-passed Medicare bill — which en- 
courages the use of e-prescribing when a physician is providing services to a Medi- 
care patient — is a great first step toward this same goal because e-prescribing will 
introduce physicians and others to the benefits of all electronic health records 
(EHRs). However, more needs to be done on the e-prescribing front. Congress needs 
to make sure that healthcare providers who do not serve the Medicare population — 
those who serve Medicaid patients, children, and adults under 65 — are e-prescribing. 
We must first jump this e-prescribing hurdle together before moving on to the other 
more complicated obstacles in our path to a comprehensive, fully interoperable 
Health IT system. 

Most importantly, we need to make sure that we are addressing the underserved 
market by providing federal funds for e-prescribing to our safety net providers. If 
the safety net is not e-prescribing, the patients it serves will not be able to receive 
the increased quality of care that comes with e-prescribing. The Health IT bill that 
is under consideration must include significant funding to help these healthcare pro- 
viders get started e-prescribing. 

The benefits of e-prescribing are well recognized. E-prescribing ensures that cru- 
cial clinical information on patients and medications are delivered at the point-of- 
care, enabling physicians (and their staff) to make informed decisions regarding the 
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treatment for their patients and automating workflow that increases efficiency and 
reduces errors. 

The Centers for Medicare and Medicaid Services (CMS) reported in November 
2007 that a shift to e-prescribing “could avoid more than two million adverse drug 
events annually, of which 130,000 are life threatening” and “has enormous potential 
to create savings in health care costs, through reduction of adverse drug events and 
in improved workflows. One recent study estimated the potential savings at $27 bil- 
lion per year in the United States.” 

The Congressional Budget office estimated that the Medicare e-prescribing provi- 
sions, alone, would save the Federal Government $2.1 billion over ten years. Imag- 
ine the savings if e-prescribing were adopted by the healthcare providers that are 
serving the rest of the nation. 

Yet, only about 2% of the estimated 1.47 billion prescription transactions in 2007 
were transmitted electronically. And only about 6% of office-based physicians are e- 
prescribing. This presents a serious problem. In order to reduce avoidable medica- 
tion errors — care providers need access to information from all physicians who are 
prescribing for that patient. E-Prescribing benefits will not be fully realized until 
it is adopted and utilized on a widespread basis. 

Therefore, in 2007 All scripts partnered with a number of key stakeholders — such 
as WellPoint, Aetna, Dell, Microsoft, Google, Sprint, and Cisco — to launch a nation- 
wide initiative to provide an easy-to-use and secure internet-enabled e-prescribing 
solution free of charge to all healthcare professionals across the nation who are eli- 
gible to prescribe. This initiative, called the National E-Prescribing Patient Safety 
Initiative (NEPSI), provides the software application, hosting, a drug interaction 
database and a medication database. 

Nevertheless, many physicians are not taking advantage of this free service. That 
is because the necessary investment in e-prescribing goes beyond the cost of soft- 
ware. Physicians face the likelihood of spending thousands of dollars on hardware, 
infrastructure, training, and practice management. They will need to invest a great 
deal of time and money to change their workflows to incorporate e-prescribing into 
their practices and convert their paper records. 

All scripts recommends that Congress provide federal funding through a dem- 
onstration program or targeted grant program that will provide funds to healthcare 
providers for hardware, infrastructure, training, and practice management. We rec- 
ommend that those funds be targeted at healthcare providers who face the biggest 
financial challenge and who otherwise might be unwilling to adopt e-prescribing — 
safety net and primary care providers. At a minimum, these funds should be distrib- 
uted in the same years that federal funding is distributed under the Medicare e- 
prescribing program. Furthermore, in order to leverage the federal investment, Con- 
gress may want to consider providing additional funding to physicians who are will- 
ing to obtain their software for free from the private sector. 

Thank you for considering my testimony. 


Deborah C. Peel, Statement 

Thank you for the opportunity to submit written testimony to the U.S. House of 
Representatives Committee on Ways and Means regarding health information tech- 
nology legislation and the importance of privacy. We commend the hard work of this 
Committee and its staff. 

The testimony being submitted here is on behalf of Patient Privacy Rights (PPR), 
a national organization that educates consumers about the importance of health pri- 
vacy, champions smart policies and technologies, and holds industry accountable to 
protect what’s most valuable — our health, our families and our reputations. Patient 
Privacy Rights has members in every state in the nation. While PPR prefers to work 
collaboratively with providers and industry we are beholden only to consumers and 
patients. PPR also leads the bipartisan Coalition for Patient Privacy, representing 
over seven million Americans, who want their rights to control personal health in- 
formation to be restored. 

As founder of PPR, I learned about the importance of privacy directly from my 
patients. A practicing physician in the field of psychiatry, I know effective treatment 
depends upon the trust established and maintained between doctor and patient. 
When I first entered private practice, people came and paid me cash on the barrel- 
head because they had lost jobs or their reputations were ruined when someone saw 
their health records that should not have. 

Sitting face to face with patients for over thirty years and hearing how their pri- 
vacy has been violated made me much more attuned to protecting their privacy. It 
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is that long-term, human contact that has made me so passionate about restoring 
privacy. Frankly, it is heart breaking to see the destruction caused when private, 
intimate information gets in the wrong hands. PPR, in operation for just a few 
years, hears daily from patients from every state in this nation, desperate for help 
and looking for justice. 

In this submitted testimony, we will reiterate why privacy is the lifeblood of effec- 
tive healthcare and successful adoption of health IT. Additionally, we will suggest 
ways to ensure both progress with health IT and privacy for all Americans. Finally, 
we will focus some comments on H.R. 6357, the bill recently reported by the Energy 
and Commerce Committee. 

The importance of privacy 

Privacy is about much more than minding one’s own business. We believe that 
“who” can see, share or buy our most sensitive health information is a policy issue 
that deserves extensive public debate and a roll call vote. Our personal health infor- 
mation is worth billions of dollars. Continued open and easy access to that informa- 
tion is the goal of the insurance industry, large employers, data mining industry, 
drug companies, the for-profit research industry and others. 

The lack of privacy is harmful and can be deadly. Millions of Americans avoid doc- 
tors and delay medical care for fear their employers will find out, their insurers will 
drop them or a vast world of strangers will know their most intimate mental, phys- 
ical, or genetic details. 

• According to HHS, two million Americans with mental illness do not seek 
treatment due to privacy concerns. 1 

• 600,000 cancer victims do not seek early diagnosis and treatment. 2 

• Millions of young Americans suffering from sexually transmitted diseases do 
not seek diagnosis and treatment (1 in 4 teen girls are now infected with a 
STD). 3 

• The California Health Care Foundation found that 1 in 8 Americans have put 
their health at risk by engaging in privacy-protective behavior: Avoiding their 
regular doctor — Asking a doctor to alter a diagnosis — Paying privately for a 
test — Avoiding tests altogether , 4 

• The Rand Corporation found that 150,000 soldiers suffering from Post-Trau- 
matic Stress Disorder (PTSD) do not seek treatment because of privacy con- 
cerns. 5 

Avoidance and delay in seeking health care costs society in real dollars, quality 
of care and life. Sadly, we have reached a point where some physicians find them- 
selves having to choose between providing thorough, complete medical diagnosis and 
treatment and putting their patients’ insurance coverage or even employment at 
risk if sensitive information is shared. 

HIPAA 

Before proceeding with our recommendations for health IT legislation, we want 
to reiterate the need to reduce the deficiencies and close the loopholes in the Health 
Insurance Portability and Accountability Act (HIPAA). First, despite the fact that 
HIPAA requires more stringent privacy-protective state laws and medical ethics to 
prevail over the privacy ‘floor’ in HIPAA, the opposite has occurred. This is all the 
more reason for federal law to ensure that what Americans say in the doctor’s office, 
stays in the doctor’s office. This expectation that the Hippocratic Oath means doc- 
tors will keep records private no longer holds true. 

Second, HIPAA regulations allowing broad access to personal health information 
for the purposes of treatment, payment and health care operations without consent 
have created not only a radical shift in the traditional relationship we have had 
with our trusted doctors, but created a vast, unregulated market that treats our 
most personal information as a commodity. Data mining and sale of health informa- 
tion is rampant. This was not the intent of Congress. In fact, clearly members of 
the Energy and Commerce committee intended to stop this practice with the inclu- 
sion of SEC. 312(d) in H.R. 6357. An excellent and timely example of this practice 
specific to prescription records was highlighted just last week by journalists at Busi- 


' 65 Fed. Reg. at 82,779 

2 65 Fed. Reg. at 82,777 

3 65 Fed. Reg. at 82,778 

4 CHCH Consumer Health Privacy Survey, June 2005 

5 “Invisible Wounds of War”, The RAND Corporation, p. 436 (2008) 
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ness Week and the Washington Post (See “They know what’s in your medicine cabi- 
net: how insurance companies dig up applicant’s prescriptions and use them to deny 
coverage,” Business Week by Chad Terhune, July 23, 2008 and “Prescription data 
used to assess consumers: records aid insurers but prompt privacy concerns,” Wash- 
ington Post by Ellen Nakashima, August 4, 2008). 

Third, until the HIPAA loopholes are closed we are strongly opposed to extending 
HIPAA to cover personal health records (PHRs) and other non-HIPAA covered enti- 
ties. While legislated policy is certainly needed to ensure privacy and security of 
PHRs and the other advances in technology, requiring these entities to comply with 
HIPAA would simply grant even more corporations the right to use protected health 
information without consent, facilitating even more data mining and sale of Ameri- 
cans’ sensitive health records. 

Congress has an opportunity to correct the above mentioned deficiencies. We cau- 
tion that any efforts to promote health IT without addressing the weaknesses in 
HIPAA will compromise the success of any the health IT system. A system without 
privacy will never produce the trust necessary to get the data needed for research, 
for quality improvement, for comparative effectiveness, to lower costs, and to save 
lives. Our mutual goal of progress and privacy is not only possible, it is the only 
way Americans will fully participate in health IT and share personal information. 
To achieve this goal we recommend the following specific measures for the commit- 
tee’s consideration. 

Recommendations 

First, in H. R. 6357 the provisions in Sec 3002(b)(2)(B)(i) need to be strengthened 
in order to ensure individuals can segment sensitive or erroneous information in 
their electronic health records. 

For example, a radiologist does not need to see psychiatric records, nor does a po- 
diatrist need to know about a pap smear. Moreover, if a patient’s information is mis- 
takenly entered in another patient’s electronic medical record as a result of medical 
identity theft, that patient should be able to suppress that information by seg- 
menting from the rest of their medical records, to avoid potentially catastrophic er- 
rors. As currently drafted, the reported version of PRO(TECH)T only requires that 
the Health IT Policy Committee consider and make recommendations on tech- 
nologies that ensure segmentation. In the current bill, it is up to the Secretary to 
determine if a recommendation for segmentation shall in fact be adopted. 

Segmentation is already required for psychotherapy notes under HIPAA. The 
states require that several categories of information not be disclosed with the rest 
of general medical records without additional authorization, and federal law re- 
quires addiction treatment information to be disclosed only with specific authoriza- 
tion. Truly, any health IT system that fails to build segmentation into its design 
is outdated. Systems capable of segmenting sensitive information, offer Americans 
far greater privacy protections than those that do not. Technologies encouraged, 
supported and required by the Federal Government should promote and ensure in- 
novation. Functionality to enable consumers to segment sensitive health information 
should be a policy required by Congress; the Secretary should be held accountable 
to implement policies — not make them. 

Second, strengthen the provisions in H. R. 6357 Sec 312(d) to ensure entities can- 
not share, sell, re-sell, or disclose electronic health information in any format with- 
out consent. The requirement to obtain consent before protected health information 
is used for health care operations is a welcome step forward. However, this provi- 
sion has two serious limitations. 

(1) The definition of “Electronic Medical Record” is very limited. For example, it 
excludes prescriptions and laboratory data that are not created by doctors or staff 
at single institutions. Tying the consent requirement to this very limited definition 
of an EMR, will not prevent the use of the majority of protected health information 
for health care operations, which was PPR’s understanding of the stated intent and 
purpose for adding this section to the bill. 

(2) The restriction on disclosures without consent should apply to every entity that 
may use protected health information, not just providers. In fact, providers are the 
least likely to use protected health information for healthcare operations. Other cov- 
ered entities and business associates, including insurers, data miners, researchers, 
corporations and others are the primary ones that exploit this loophole in HIPAA. 

Third, we recommend including the NCVHS definition of privacy in the bill, 
“health information privacy” means an individual’s right to control the acquisition, 
uses, or disclosures of his or her identifiable health data. The “P” in HIPAA does 
not stand for privacy. It is important for all stakeholders to speak the same lan- 
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guage. The definition of privacy is just as essential as any of the other terms defined 
in this bill 

Fourth, we recommend the committee first establish a solid understanding of the 
actual uses of our personal health information in the marketplace. The health and 
health IT industry is a world clearly developing far faster than government regula- 
tions and standards. An essential part of this process should include investigations 
and documentation of the actual uses of our health information and the various 
markets that are sharing and selling our information today. With the exception of 
recent reports highlighting alarming rates of breaches, and dismal privacy and secu- 
rity within federal agencies, the public and Congress is frankly in the dark about 
the widespread under-the-radar use of personal health information. Patient Privacy 
Rights urges the committee to include provisions requiring a GAO (or similar body) 
study on the following: 

• The extent that Federal Government databases are shared with other federal, 
state and local agencies. 

• An accounting of all uses of personal health information for treatment, pay- 
ment and operations by entities with federal health contracts. 

In addition, we recommend Sec 303(b) of H.R. 6357 be revised so that reports cov- 
ering reported HIPAA violations and the outcomes of those investigations are sub- 
mitted quarterly versus only once/year. Furthermore, a report of all breaches of 
PHI, the notification of the breach, corrective action and any history of repeat of- 
fenders should be delivered to Congress quarterly. An investigatory hearing into the 
health data mining industry and the sale of personal health information would also 
be a very worthy exercise, bringing to light the massive secret misuse of the nation’s 
sensitive personal health information. 

Furthermore, clearly for privacy protections to be meaningful, they must be en- 
forceable and enforced. We recommend that the RICO statute apply to entities that 
violate the law and improperly use, sell or share personal health information. Such 
entities should also be prohibited from winning any future federal contracts. Inclu- 
sion of a qui tam like provision, which authorizes private citizens to assist govern- 
ment prosecutors in enforcing the law, is also a proven mechanism to help accom- 
plish the essential task of effective enforcement. Without it, prosecution of privacy 
law violations will rarely be a high priority. 

Thank you for the opportunity to present our concerns and recommendations to 
the committee on this critical issue. We strongly believe that if we “build it right, 
they will come.” If the electronic health information systems meet our citizens’ pri- 
vacy needs, all Americans, not just early adapters, will utilize such progressive tools 
and reap the potential rewards of health IT. We can and must ensure both progress 
and privacy. Americans need Congress to ensure that consent for treatment protects 
us as we come through the front door and laws preventing further disclosure and 
onward transfer protects our sensitive information from flowing out the back door. 
This is reasonable, achievable and will do worlds of good in this electronic health 
IT arena. 


Jeffrey Kendal, Statement 

Thank you for the opportunity to submit this testimony on the vital topic of 
health information technology. Expanding the use of information technology in the 
health care sector has great potential to reduce costs and improve quality of care. 
We commend the Subcommittee for focusing its attention on this critical area. 

We have seen interoperable information technology systems drive tremendous im- 
provements in customer service and cost containment in several industries over the 
last couple of decades. The banking industry and the travel industry are two good 
examples. They have utilized interoperable customer records and self-service tech- 
nologies to dramatically improve the customer experience. The health care sector 
has been slower to adopt these technologies, but we are now seeing technology adop- 
tion start to pick up steam. 

The reason health IT is gaining momentum is because of its well-established ben- 
efits: 

• Reducing medical errors; 

• Expanding care to hard-to-serve areas through telemedicine; 

• Restraining the growth in health care costs; 

• Reducing wait times and unnecessary delays; 

• Empowering patients and their physicians. 
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All of these benefits are achievable for health care organizations, ranging from 
major medical centers to small town clinics. However, to maximize these benefits, 
it is critical that we make more progress on creating broadly accepted standards for 
interoperable electronic health records. Standardized EHRs are the key to unlocking 
the most significant benefits of health IT. 

A strong partnership between private industry and the Federal Government is 
necessary to create these standards. That is why we support the work of the Na- 
tional Coordinator for Health IT. We also support legislation being considered in 
both the House and the Senate to strengthen the role of the Coordinator. These bi- 
partisan bills would also solidify the role of the IT and health care industries as 
partners in standards development, and provide funding for pilot projects in under- 
served areas. 

We hope that Congress will redouble its effort between now and adjournment to 
pass this legislation this year. We also hope that Congress will resist the temptation 
to add costly mandates that might have the unintended consequence of discouraging 
private sector investment in health IT systems. If Congress passes a balanced, tech- 
nology-neutral bill this year, it will help kick-start the drive toward a standardized 
electronic health record. 

While the path to nationwide health IT adoption has been somewhat slow, a num- 
ber of hospitals, clinics and private practices around the country have been early 
adopters, and they have found the benefits to be substantial. I will give you a brief 
example with which we are familiar. 

Empowering Patients — Reducing Wait Times: 

The Medical Center of Central Georgia (MCCG) is a 600-bed acute care hospital 
that serves a 30-county area. MCCG is home to the Georgia Heart Center, which 
performs more than 1,100 heart surgeries each year. The hospital faced serious 
challenges in its patient intake and registration process. Registration bottlenecks 
led to some patients having to wait 20 to 25 minutes to see a registration clerk. 
Doctors’ time was wasted because they had to wait while patients cleared the reg- 
istration process. The process created stress for the staff and resulted in staff turn- 
over. 

In 2007, the hospital began piloting information technology tools designed to cre- 
ate an electronic registration process. The system was built around electronic health 
records and self-service kiosks. The results have been eye-opening. Patient wait 
times have been reduced by about 20 minutes; doctors’ time is better utilized; staff 
morale has improved; and patient satisfaction scores are higher. 

In addition, the hospital has been able to reduce costs by eliminating repetitive 
re-keying of information and scanning of paper documents. They have dramatically 
improved efficiency by streamlining processes for capturing patient information, 
submitting claims and managing medical records. At a time when declining reim- 
bursements are pressuring hospitals to operate more efficiently, health IT systems 
are helping to reduce costs and free up staff to focus on patient care. 

As a result of this well-designed use of health IT, service to the patient has been 
improved and the hospital’s resources are being better utilized — a win-win for every- 
one. 

Conclusion: 

This example illustrates the benefits of one type of health IT — self-service tech- 
nologies. These technologies empower patients, reduce errors, shorten wait times, 
and eliminate repetitive data entry requirements. Demand for, and acceptance of, 
time-saving self-service technologies is growing rapidly. Our annual survey con- 
ducted this spring found that 89% of health-care customers are willing and able to 
take advantage of self-service systems. It also found that 46% of respondents consid- 
ered increased privacy a key benefit of self-service technologies. 

This is just one type of health IT. There are many other beneficial health IT sys- 
tems, including e-prescribing to reduce dangerous medication errors, and tele-medi- 
cine to expand health care access. 

The benefits and savings associated with health IT investments are compelling. 
Electronic health records and the health IT systems that they empower will help 
to improve patient safety and rein in the high cost of health care. Congress can help 
foster continued adoption of health IT by: 

• Passing Health IT legislation this year; 

• Avoiding technology mandates that discourage investment in new tech- 
nologies; 
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• Avoiding other types of mandates that may discourage investment in health 
IT systems; and 

• Conducting regular oversight of the process of establishing health IT stand- 
ards. 

Thank you again for the opportunity to submit this testimony, and thank you for 
the constructive role you are playing in helping to promote the benefits of health 
IT. I would be happy to provide any additional information that would be helpful. 


John J. Castellani, Statement 

Business Roundtable is an association of 160 chief executive officers of leading 
U.S. companies with $4.5 trillion in annual revenues and more than 10 million em- 
ployees. Member companies comprise nearly a third of the total value of the U.S. 
stock markets and represent over 40 percent of all corporate income taxes paid to 
the Federal Government. Collectively, Business Roundtable companies returned one 
hundred fourteen billion dollars in dividends to shareholders and the economy in 
2006. The goal of Business Roundtable’s public policy priorities is to ensure a vi- 
brant economy and a competitive workforce. High health care costs are inhibiting 
job creation, hurting our ability to compete in global markets and straining the 
household incomes of many Americans. For Business Roundtable CEOs, health care 
costs are the number one cost pressure they face. 

Business Roundtable companies provide health care coverage to more than 35 mil- 
lion Americans. We believe an affordable, accessible, high-quality health care system 
is of critical importance not only to Roundtable companies but to all Americans. 
Health information technology (HIT) is an essential component of a high quality 
21st century health care system that would promote efficiencies, reduce errors and 
provide the technological platform to assess the quality and value of health care. 

To advance our health system, the health care industry needs to invest in and 
deploy HIT. In order for this to happen the industry needs to know the rules will 
not change and that is why Congress must act. Four things must be done at the 
federal level: 

• Establish federal leadership for a public-private process to set standards; 

• Offer financial incentives to encourage the adoption of HIT; 

• Educate Americans on the value of electronic health records and information 
on the quality of providers; and 

• Address privacy and security questions as the system is deployed. 

Our health care system is one of the few segments of the American economy that 
has not been transformed by modern, efficient information technology. This is not 
just inconvenient — it’s costly and, in some cases, even lethal. An estimated 98,000 
people die each year from medical errors, many of which might have been prevented 
with accurate and up-to-date electronic records. According to the RAND Corpora- 
tion, widespread adoption of health IT has the potential to save as much as $165 
billion a year from efficiencies and improved health outcomes. 

When widely implemented, information technology will deliver a whole new di- 
mension of choice, convenience and control to America’s health care consumer. Pa- 
tients will be able to access their medical histories, underserved communities in 
rural areas and inner cities will enjoy greater access to health care, adult children 
will be better able to care for their aging parents from far away, and doctors will 
be able to better monitor their patients. 

We encourage the Committee to allow the adoption of HIT in the Medicare pro- 
gram. In June 2007, Business Roundtable released “Principles for Reform,” which 
includes the principle that our health care system should promote and reward qual- 
ity performance and the use of HIT. We recognize that payers in our health care 
system may need some incentives, either increased reimbursement or grants and 
loans, to encourage the adoption of health information technology. 

We also applaud the introduction of HIT legislation by several leaders in Congress 
including: Energy & Commerce Chairman John Dingell (D-MI) and Ranking Mem- 
ber Joe Barton (R-TX) for their introduction of H.R. 6357, the bipartisan “Protecting 
Records, Optimizing Treatment, and Easing Communication through Health Care 
Technology Act,” or “PRO(TECH)T Act;” Congresswoman Anna Eshoo (D-CA) and 
Congressman Michael Rogers (R-MI), for the introduction of H.R. 3800, the bipar- 
tisan “Promoting Health Information Technology Act;” and the Senate’s bipartisan 
S. 1693 “Wired for Health Care Quality Act.” 



139 


These bills would establish the foundation in law that is required for the wide- 
spread deployment of health IT. With this foundation, the adoption of health infor- 
mation technology would be accelerated and our U.S. health care system would be- 
come more efficient and effective which would benefit all Americans. 

Business Roundtable CEOs have joined in a “Call to Action” (Divided We Fail) 
with AARP, the Service Employees International Union (SEIU) and the National 
Federation of Independent Business (NFIB) to engage the American people, busi- 
nesses, non-profit organizations and elected officials in finding bipartisan solutions 
like health IT to ensure affordable, quality health care for all. Congress, the Admin- 
istration, the health care industry and the public are united behind HIT, and the 
Roundtable has made HIT legislation our number-one health care reform priority for 
2008. 

Congress has the opportunity to take a big first step toward the goal of an afford- 
able, accessible, high-quality 21st century health care system. We urge all members 
of Congress to pass legislation similar to the bills cited above that can be signed 
into law by the President during this Congress. 


The Computing Technology Industry Association, Statement 
Introduction 

Chairman Stark, Ranking Member Camp, and Members of the Subcommittee, 
thank you for holding this important hearing to explore options of promoting of 
health information technology (HIT). My name is Roger J. Cochetti and I am sub- 
mitting testimony on behalf of the Computing Technology Industry Asso- 
ciation (CompTIA) representing our 20,000 member companies. 

While nearly every industry has digitized records and communications, the health 
care industry remains in the analog, pen-and-paper world. Daily, there are new 
breakthroughs in medical imaging technology, yet the orders for such exams remain 
hand-written. The current regime of paper records is costly, inefficient, unsecure, 
and frequently impedes patients from receiving best care possible. 

This is a real issue affecting the cost and quality of health care in America, and 
this issue is in urgent need of an immediate response. We believe your efforts to 
focus both congressional and public attention on this issue are most important. 

CompTIA Overview 

The Computing Technology Industry Association represents the business interests 
of the information technology industry. For over 25 years, CompTIA has provided 
research, networking, and partnering opportunities to its over 10,000, mostly-Amer- 
ican, member companies. Nearly 75% of our membership is comprised of American 
Value Added Resellers, or VARs. These small, system integrators set up and main- 
tain computer systems and networks for small businesses — including medical prac- 
tices. An estimated 32,000 American VARs sell some $43 billion dollars worth of 
computer hardware, software, and services — mostly to the small businesses that 
drive the American economy. This means that around one-third of the computer 
hardware and software sold in the U.S. today is sold by VARs. 

As further background, in addition to representing the interests of VARs, 
CompTIA also works to provide global policy leadership for the IT industry through 
our headquarters in Chicago and our public policy offices in Washington, Brussels, 
Hong Kong, and Sao Paulo. 

Finally Mr. Chairman, for most people who work with computer technology, 
CompTIA is probably best known for the non-policy-related services that it provides 
to advance industry growth through standards, professional certifications, industry 
education, and business solutions. In order to most effectively serve the industry 
and our members, CompTIA has developed specialized initiatives and programs 
dedicated to major areas within the IT industry. 

Today, over one million IT professionals — mostly American technology workers — 
possess one or more CompTIA certifications; and each month between 10,000 and 
15,000 American IT workers take one or more of the CompTIA certification exams. 

The Issue: Cost vs. Benefit 

As the Committee is well aware, the benefits of HIT — ranging from e-prescribing 
to portable, interoperable electronic health records — are far reaching. A RAND 
study in 2005 estimated that HIT could yield an annual net savings to the health 
care sector of about $80 billion per year if all providers and hospitals adopted health 
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information technology and used it appropriately. 1 With total spending for health 
care at about $2 trillion per year, this represents a 4% savings. These savings would 
be the result of better administration of scheduling, coordination, and billing, better 
utilization of nurses — who could increase the portion of their time with patients as 
opposed to administrative work, increased safety, reduced hospital stays, and more 
efficient drug treatments. All of these benefits lead to the most important benefit 
of HIT, improved patient care. Portable, interoperable electronic health records 
(EHRs) will reduce medical errors, increase collaboration amongst physicians, and 
improve disease prevention and management. 

Unfortunately, approximately only 4 percent of physicians have fully functional 
EHR systems and only 13 percent have even basic EHR systems. 2 It is signifi- 
cant to note that physicians who practiced in groups of at least 50 were three 
times more likely as those in very small practices (three doctors or less) to have a 
basic EHR system. 3 Clearly, practice size impacts HIT uptake and should be ad- 
dressed in any legislative solution. 

Other impediments to uptake include cost in time and money, concerns about li- 
ability, lack of trained personnel, hesitance to change, concern about standards, and 
the fact that doctors bear the brunt of the cost but patients and payors receive most 
of the benefit. Purchasing and installing an electronic prescribing system costs a 
practice several thousand dollars and implementing a full EHR system costs tens 
of thousands of dollars. Additionally, a practice must bear the cost of downtime re- 
quired to install the system and train employees, as well as annual maintenance 
and any new liabilities. While a practice can be back online at full capacity in a 
short time-period, the initial estimates can be daunting. In addition to being hesi- 
tant to change, the possibilities of transitioning to a new system before all technical 
standards have been established or creating a new area of liability gives physicians 
further pause. Finally, if a practice makes it to the point of full implementation, the 
cost savings highlighted above are not captured by the physicians, but rather the 
payors. As such there is little motivation for individual doctors and smaller medical 
practices to implement HIT that could have a transformative impact on health care. 

Solutions 

CompTIA was glad to see positive first steps in promoting HIT when Congress 
included e-prescribing provisions in the recently passed “Medicare Improvements for 
Patients and Providers Act of 2008” (P.L. 110-275). Both lives and money will be 
saved as medication errors from incorrect dosages, allergies, and negative inter- 
actions are decreased. However, this was only the first of many necessary steps to 
promote broad implementation of HIT. 

In order to succeed in establishing broad, portable, interoperable HIT, medical 
care providers — particularly small providers — must be encouraged to implement and 
maintain HIT systems in their practices. HIT will not be universally successful un- 
less it is adopted by the broadest health care provider group — the small health care 
practitioner. Clearly, the predominant obstacle for this group will be the costs of 
purchase, installation, and maintenance of a HIT system for their practice. In this 
regard, CompTIA continues to call for incentives that will enable small health care 
providers to join in the HIT evolution. 

In his testimony, Dr. Orszag explained that “carrots” only benefit those already 
on the verge of implementing HIT, whereas sticks will influence behavior through- 
out the medical industry. While this may be true, it does not address the fact that 
smaller practices face ever-tightening profit margins and cannot rationalize such a 
large investment with such a little return. It is imperative that the Committee con- 
sider who pays the cost and who bears the benefit of implementing HIT. Doctors 
and practices cannot bear the cost of “sticks” without the benefit of “carrots” as well. 
CompTIA has long supported tax credits for physicians that implement HIT. As the 
Committee develops draft legislation, they must consider the cost to physicians, ad- 
dress the concerns of both large and small practices, and consider other impedi- 
ments, such as liability. 


1 Hillestad R, Bigelow J, Bower A, Girosi F, Meili R, Scoville R, and Taylor R, “Can Electronic 
Medical Record Systems Transform Healthcare? An Assessment of Potential Health Benefits, 
Savings, and Costs,” Health Affairs, Vol. 24, No. 5, September 14, 2005. 

2 “Physician Adoption of Electronic Health Records Still Extremely Low, but Medicine May Be 
At a Tipping Point,” Health Information Technology Adoption Initiative press release, June 18, 
2008. http://hi tadoption.org/index. php?module=News&id=cntnt01&cntnt01action= 

detail &cnt.nt.01 articleid=4&cntnt01 return id=30 

3 Ibid. 
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Conclusion 

The cost of health care is growing astronomically. HIT could be a valuable tool 
in curbing some of the costs, while improving health care quality and security but 
broad implementation will remain a pipe dream until there are financial incentives 
in place for doctors and small practices to implement systems and the standards for 
definitions, interoperability, and privacy are addressed. As the Committee develops 
legislation, we encourage you to include financial incentives for uptake — especially 
for small practices — and further the standards discussions. 

CompTIA is hopeful that technology will revolutionize health care through HIT 
in the same way technology and digitization has revolutionized other industries. We 
are confident that robust, interoperable HIT systems will lead to better patient care 
and cost savings. We thank you for the opportunity to voice our concerns and rec- 
ommendations, and look forward to reading draft legislation as soon as it is avail- 
able. 

o 



